Skip to content
OpenAdvisories
High RHSA-2026:2399 1 CVE

Red Hat Security Advisory: brotli security update

Published Feb 10, 2026 · Updated Oct 9, 2026

Ecosystem: Red Hat

Fixed packages 18

ReleasePackageFixed in
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream brotli-debuginfo 0:1.0.6-4.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream brotli-debugsource 0:1.0.6-4.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream brotli-devel 0:1.0.6-4.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream python3-brotli 0:1.0.6-4.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream python3-brotli-debuginfo 0:1.0.6-4.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos brotli 0:1.0.6-4.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos brotli-debuginfo 0:1.0.6-4.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos brotli-debugsource 0:1.0.6-4.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::baseos python3-brotli-debuginfo 0:1.0.6-4.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream brotli-debuginfo 0:1.0.6-4.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream brotli-debugsource 0:1.0.6-4.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream brotli-devel 0:1.0.6-4.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream python3-brotli 0:1.0.6-4.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::appstream python3-brotli-debuginfo 0:1.0.6-4.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos brotli 0:1.0.6-4.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos brotli-debuginfo 0:1.0.6-4.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos brotli-debugsource 0:1.0.6-4.el8_4
Red Hat · RHEL 8.4 EUS Long Life rhel_eus_long_life:8.4::baseos python3-brotli-debuginfo 0:1.0.6-4.el8_4

Vulnerabilities 1

  • High 7.5
    CVE-2025-6176

    Brotli decompression bomb DoS in scrapy/scrapy

    Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to cra…

    scrapy scrapy/scrapy mitmproxy scrapy Debian Ubuntu Wolfi PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2408762
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2399.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-6176
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-6176
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-6176
  • article
    https://huntr.com/bounties/2c26a886-5984-47ee-a421-0d5fe1344eb0