Skip to content
OpenAdvisories
High ELSA-2026-0845 1 CVE

Important: brotli security update (Oracle Linux 10)

Published Jan 20, 2026 · Updated Jan 20, 2026

Ecosystem: Oracle Linux

Summary

[1.1.0-7]
- Resolves: RHEL-133984
CVE-2025-6176 Brotli decompression bomb DoS in scrapy

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 10 brotli 0:1.1.0-7.el10_1
Oracle Linux · 10 brotli-devel 0:1.1.0-7.el10_1
Oracle Linux · 10 libbrotli 0:1.1.0-7.el10_1
Oracle Linux · 10 python3-brotli 0:1.1.0-7.el10_1

Vulnerabilities 1

  • High 7.5
    CVE-2025-6176

    Brotli decompression bomb DoS in scrapy/scrapy

    Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to cra…

    scrapy scrapy/scrapy mitmproxy scrapy Debian Ubuntu Wolfi PyPI