Skip to content
OpenAdvisories
High ELSA-2026-2389 1 CVE

Important: brotli security update (Oracle Linux 8)

Published Feb 10, 2026 · Updated Feb 10, 2026

Ecosystem: Oracle Linux

Summary

[1.0.6-4]
- Resolves: RHEL-133986
CVE-2025-6176 Brotli decompression bomb DoS in scrapy

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 8 brotli 0:1.0.6-4.el8_10
Oracle Linux · 8 brotli-devel 0:1.0.6-4.el8_10
Oracle Linux · 8 python3-brotli 0:1.0.6-4.el8_10

Vulnerabilities 1

  • High 7.5
    CVE-2025-6176

    Brotli decompression bomb DoS in scrapy/scrapy

    Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to cra…

    scrapy scrapy/scrapy mitmproxy scrapy Debian Ubuntu Wolfi PyPI