Description
Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| scrapy | scrapy/scrapy | unspecified – ≤ latest | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-scrapy | 2.13.4-1 | — |
| Debian 13 | python-scrapy | No fix yet | — |
| Debian 12 | python-scrapy | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python-scrapy | No fix yet | — |
| Ubuntu 26.04 LTS | python-scrapy | No fix yet | — |
| Ubuntu 25.10 | python-scrapy | No fix yet | — |
| Ubuntu 16.04 LTS | python-scrapy | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | python-scrapy | No fix yet | — |
| Ubuntu Pro 22.04 LTS | python-scrapy | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python-scrapy | No fix yet | — |
| Ubuntu Pro 18.04 LTS | python-scrapy | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | brotli +3 | 1.1.0-7.el10_1 | RHSA-2026:0845 |
| RHEL 9 | brotli +3 | 1.0.9-9.el9_7 | RHSA-2026:2042 |
| RHEL 8 | brotli +2 | 1.0.6-4.el8_10 | RHSA-2026:2389 |
Show 17 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.12.0.14-1.el8sat | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite Utils 6 | satellite +1 | 6.17.7-1.el9sat | RHSA-2026:5970 |
| Red Hat Satellite Maintenance 6 | libcomps +1 | 0.1.23-0.3.el9pc | RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | foreman +2 | 3.12.0.14-1.el8sat | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | libcomps +2 | 0.1.23-0.3.el9pc | RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | python-brotli +1 | 1.2.0-0.1.el8pc | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | python-django +1 | 4.2.28-0.1.el8pc | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | python-pulp-container +1 | 2.22.3-1.el9pc | RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | python-pulp-rpm +1 | 3.27.10-2.el9pc | RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | rubygem-rubyipmi | 0.13.0-0.1.el8sat | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite Capsule 6 | satellite +3 | 6.17.7-1.el9sat | RHSA-2026:5970 |
| Red Hat Satellite 6 | foreman +14 | 3.12.0.14-1.el8sat | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite 6 | libcomps +2 | 0.1.23-0.3.el9pc | RHSA-2026:5970 |
| Red Hat Satellite 6 | python-brotli +1 | 1.2.0-0.1.el8pc | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite 6 | python-django +1 | 4.2.28-0.1.el8pc | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite 6 | python-pulp-container +1 | 2.22.3-1.el9pc | RHSA-2026:5970 |
| Red Hat Satellite 6 | python-pulp-rpm +1 | 3.27.10-2.el9pc | RHSA-2026:5970 |
| Red Hat Satellite 6 | rubygem-fog-kubevirt | 1.5.1-1.el8sat | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite 6 | rubygem-foreman_kubevirt | 0.2.0-2.el8sat | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite 6 | rubygem-katello | 4.16.0.14-1.el9sat | RHSA-2026:5970 |
| Red Hat Satellite 6 | rubygem-rubyipmi | 0.13.0-0.1.el8sat | RHSA-2026:5971, RHSA-2026:5970 |
| Red Hat Satellite 6 | satellite +3 | 6.17.7-1.el9sat | RHSA-2026:5970 |
| Red Hat Satellite 6 | yggdrasil-worker-forwarder | 0.0.3-4.el8sat | RHSA-2026:5971, RHSA-2026:5970 |
| RHEL 10.0 EUS | brotli +3 | 1.1.0-6.el10_0.1 | RHSA-2026:0008 |
| RHEL 9.6 EUS | brotli +3 | 1.0.9-7.el9_6.1 | RHSA-2026:2229 |
| RHEL 9.4 EUS | brotli +3 | 1.0.9-6.el9_4.1 | RHSA-2026:2227 |
| RHEL 9.2 E4S | brotli +3 | 1.0.9-6.el9_2.1 | RHSA-2026:2228 |
| RHEL 9.0 E4S | brotli +3 | 1.0.9-6.el9_0.1 | RHSA-2026:2226 |
| RHEL 8.8 TUS | brotli +2 | 1.0.6-4.el8_8 | RHSA-2026:2400 |
| RHEL 8.8 E4S | brotli +2 | 1.0.6-4.el8_8 | RHSA-2026:2400 |
| RHEL 8.6 TUS | brotli +2 | 1.0.6-4.el8_6 | RHSA-2026:2455 |
| RHEL 8.6 E4S | brotli +2 | 1.0.6-4.el8_6 | RHSA-2026:2455 |
| RHEL 8.6 AUS | brotli +2 | 1.0.6-4.el8_6 | RHSA-2026:2455 |
| RHEL 8.4 EUS Long Life | brotli +2 | 1.0.6-4.el8_4 | RHSA-2026:2399 |
| RHEL 8.4 AUS | brotli +2 | 1.0.6-4.el8_4 | RHSA-2026:2399 |
| RHEL 8.2 AUS | brotli | 1.0.6-1.el8_2.1 | RHSA-2026:2401 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | brotli +3 | 1.1.0-7.el10_1 | ALSA-2026:0845 |
| AlmaLinux 9 | brotli +3 | 1.0.9-9.el9_7 | ALSA-2026:2042 |
| AlmaLinux 8 | brotli +2 | 1.0.6-4.el8_10 | ALSA-2026:2389 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | brotli | 1.1.0-7.el10_1 | RLSA-2026:0845 |
| Rocky Linux 9 | brotli | 1.0.9-9.el9_7 | RLSA-2026:2042 |
| Rocky Linux 8 | brotli | 1.0.6-4.el8_10 | RLSA-2026:2389 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | python-Brotli | 1.2.1-160000.1.1 | SUSE-SU-2026:24597-1 |
| SLES 16.0 | python-Brotli | 1.2.1-160000.1.1 | SUSE-SU-2026:24597-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-Brotli | 1.2.0-1.1 | openSUSE-SU-2025:15731-1 |
| openSUSE Tumbleweed | python-Scrapy | 2.13.3-2.1 | openSUSE-SU-2025:15732-1 |
| openSUSE Tumbleweed | python-py7zr | 1.1.0-1.1 | openSUSE-SU-2026:10227-1 |
| openSUSE Leap 16.0 | python-Brotli | 1.2.1-160000.1.1 | openSUSE-SU-2026:22183-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | brotli +3 | 1.1.0-7.el10_1 | ELSA-2026-0845 |
| Oracle Linux 9 | brotli +3 | 1.0.9-9.el9_7 | ELSA-2026-2042 |
| Oracle Linux 8 | brotli +2 | 1.0.6-4.el8_10 | ELSA-2026-2389 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | mitmproxy | 12.2.1-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | brotli | < 1.2.0 | 1.2.0 | GHSA-2qfp-q593-8484 |
| PyPI | scrapy | < 2.13.4 | 2.13.4 | GHSA-2qfp-q593-8484 |
Advisories 30
- SUSE-SU-2026:24597-1 Security update for python-Brotli SUSE / openSUSE Security Updates · Nov 10, 2026
- WID-SEC-2026-0008 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- openSUSE-SU-2026:22183-1 Security update for python-Brotli SUSE / openSUSE Security Updates · Oct 31, 2026
- ALSA-2026:0845 Important: brotli security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:2042 Important: brotli security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:2389 Important: brotli security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:5971 Red Hat Security Advisory: Satellite 6.16.7 Async Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:5970 Red Hat Security Advisory: Satellite 6.17.7 Async Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:2455 Red Hat Security Advisory: brotli security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:2401 Red Hat Security Advisory: brotli security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:2400 Red Hat Security Advisory: brotli security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:2389 Red Hat Security Advisory: brotli security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:2399 Red Hat Security Advisory: brotli security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:2229 Red Hat Security Advisory: brotli security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:2227 Red Hat Security Advisory: brotli security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:2228 Red Hat Security Advisory: brotli security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:2226 Red Hat Security Advisory: brotli security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:2042 Red Hat Security Advisory: brotli security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:0845 Red Hat Security Advisory: brotli security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:0008 Red Hat Security Advisory: brotli security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- WID-SEC-2026-0783 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
- openSUSE-SU-2026:10227-1 python311-py7zr-1.1.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15731-1 python311-Brotli-1.2.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15732-1 python-Scrapy-doc-2.13.3-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- RLSA-2026:2389 Important: brotli security update Rocky Linux Security Advisories · Feb 11, 2026
- ELSA-2026-2389 Important: brotli security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 10, 2026
- RLSA-2026:2042 Important: brotli security update Rocky Linux Security Advisories · Feb 7, 2026
- ELSA-2026-2042 Important: brotli security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Feb 5, 2026
- RLSA-2026:0845 Important: brotli security update Rocky Linux Security Advisories · Jan 21, 2026
- ELSA-2026-0845 Important: brotli security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jan 20, 2026