Skip to content
OpenAdvisories
High RHSA-2026:0845 1 CVE

Red Hat Security Advisory: brotli security update

Published Jan 21, 2026 · Updated Oct 9, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.1 brotli 0:1.1.0-7.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 brotli-debuginfo 0:1.1.0-7.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 brotli-debugsource 0:1.1.0-7.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 brotli-devel 0:1.1.0-7.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 libbrotli 0:1.1.0-7.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 libbrotli-debuginfo 0:1.1.0-7.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 python3-brotli 0:1.1.0-7.el10_1
Red Hat · RHEL 10 enterprise_linux:10.1 python3-brotli-debuginfo 0:1.1.0-7.el10_1

Vulnerabilities 1

  • High 7.5
    CVE-2025-6176

    Brotli decompression bomb DoS in scrapy/scrapy

    Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to cra…

    scrapy scrapy/scrapy mitmproxy scrapy Debian Ubuntu Wolfi PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2408762
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0845.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-6176
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-6176
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-6176
  • article
    https://huntr.com/bounties/2c26a886-5984-47ee-a421-0d5fe1344eb0