Skip to content
OpenAdvisories
High ELSA-2026-2042 1 CVE

Important: brotli security update (Oracle Linux 9)

Published Feb 5, 2026 · Updated Feb 5, 2026

Ecosystem: Oracle Linux

Summary

[1.0.9-9]
- Resolves: RHEL-133995
Rebuild for CVE-2025-6176 Brotli decompression bomb DoS in scrapy

[1.0.9-8]
- Resolves: RHEL-133995
CVE-2025-6176 Brotli decompression bomb DoS in scrapy

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 9 brotli 0:1.0.9-9.el9_7
Oracle Linux · 9 brotli-devel 0:1.0.9-9.el9_7
Oracle Linux · 9 libbrotli 0:1.0.9-9.el9_7
Oracle Linux · 9 python3-brotli 0:1.0.9-9.el9_7

Vulnerabilities 1

  • High 7.5
    CVE-2025-6176

    Brotli decompression bomb DoS in scrapy/scrapy

    Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to cra…

    scrapy scrapy/scrapy mitmproxy scrapy Debian Ubuntu Wolfi PyPI