PYSEC-2026-1906 Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation

Scrapy versions up to 2.13.3 are vulnerable to a denial of service DoS attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of...

The vulnerability of the Brotli data compression algorithm lies in the lack of a mechanism to verify the size of the copied data. This allows attackers to compromise the integrity of the data and also cause service failures.

The vulnerability of the Brotli data compression algorithm is related to the lack of a mechanism for checking the size of the copied data. Exploiting this vulnerability can allow an attacker, operating remotely, to compromise the integrity of the data and also cause service interruptions...