CVE-2025-6176
HighAdvisory
Published 31 Oct 2025In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.005
- 41st percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 255
- of 17,781 indexed, latest versions
- Container images
- 287
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation
Carried by container images the latest versions of 255 of 17,781 indexed charts deploy, on 287 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| brotlirpm | 1.0.6-1.el8, 1.0.6-2.el8, 1.0.6-3.el8, 1.0.9-6.el9+2 more | 0:1.0.6-4.el8_10, 0:1.0.9-9.el9_7, 0:1.1.0-7.el10_1 | 238 |
| brotlipypi | 1.0.9, 1.1.0 | 1.2.0 | 49 |
- OSV records
- GHSA-2qfp-q593-8484RHSA-2026:0845RHSA-2026:2042RHSA-2026:2389RLSA-2026:2042
- Also known as
- PYSEC-2026-1906, PYSEC-2026-2401, RHSA-2026:2227, RHSA-2026:2228, RHSA-2026:2229, RHSA-2026:2399, RHSA-2026:2400, RHSA-2026:2401, RHSA-2026:2455
Charts affected
255 by stars
Container images carrying it
287 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| gurolakman/ | ce23b20a8a17 | brotli | 0:1.0.6-4.el8_10 | 1 |
| gurolakman/ | b22e746edd5d | brotli | 0:1.0.6-4.el8_10 | 1 |
| gurolakman/ | bf18525c5ad9 | brotli | 0:1.0.6-4.el8_10 | 1 |
| gurolakman/ | 8739565c3ea2 | brotli | 0:1.0.6-4.el8_10 | 1 |
| hansehe/ | bc8e45262bc4 | brotli | 1.2.0 | 1 |
| hayk96/ | 86377705e9e3 | brotli | 1.2.0 | 1 |
| hazelcast/ | f9d34300d330 | brotli | 0:1.0.6-4.el8_10 | 1 |
| homeassistant/ | 021e2afc6e57 | brotli | 1.2.0 | 1 |
| homeassistant/ | 8d000332b09b | brotli | 1.2.0 | 1 |
| hyperledgerk8s/ | 29a8af8be270 | brotli | 0:1.0.6-4.el8_10 | 1 |
| hyperledgerk8s/ | 729b3d128487 | brotli | 0:1.0.6-4.el8_10 | 1 |
| hyperledgerk8s/ | ed0b0c56f1ea | brotli | 0:1.0.6-4.el8_10 | 1 |
| ibmcom/ | c796a4c693b4 | brotli | 0:1.0.6-4.el8_10 | 1 |
| ibmcom/ | 9c73804b37a3 | brotli | 0:1.0.6-4.el8_10 | 1 |
| ibmcom/ | d28bf361327a | brotli | 0:1.0.6-4.el8_10 | 1 |
| ibmcom/ | cd5065df7304 | brotli | 0:1.0.6-4.el8_10 | 1 |
| inventree/ | a946ec09da3e | brotli | 1.2.0 | 1 |
| kubeflow/ | 5783f6db428f | brotli | 0:1.0.6-4.el8_10 | 1 |
| kuberay/ | 4e6ac8a3a2c4 | brotli | 0:1.0.6-4.el8_10 | 1 |
| langgenius/ | 066035f93856 | brotli | 1.2.0 | 1 |
| langgenius/ | fca918260dd6 | brotli | 1.2.0 | 1 |
| linuxserver/ | 241009026e6f | brotli | 1.2.0 | 1 |
| locustio/ | 51d866285170 | brotli | 1.2.0 | 1 |
| minio/ | 55f3aef5803e | brotli | 0:1.0.6-4.el8_10 | 1 |
| minio/ | 2a374c124d44 | brotli | 0:1.0.6-4.el8_10 | 1 |
| minio/ | 4b415310d8d0 | brotli | 0:1.0.6-4.el8_10 | 1 |
| minio/ | c631532a394e | brotli | 0:1.0.6-4.el8_10 | 1 |
| minio/ | 1484c87239ea | brotli | 0:1.0.6-4.el8_10 | 1 |
| minio/ | 6d770d7f255c | brotli | 0:1.0.6-4.el8_10 | 1 |
| minio/ | f9576903f19d | brotli | 0:1.0.6-4.el8_10 | 1 |
| minio/ | fc6bedc99355 | brotli | 0:1.0.6-4.el8_10 | 1 |
| minio/ | 170b154d2c61 | brotli | 0:1.0.6-4.el8_10 | 1 |
| minio/ | 2adc5be088f5 | brotli | 0:1.0.6-4.el8_10 | 1 |
| opencsghq/ | 2f03fead54db | brotli | 1.2.0 | 1 |
| pangeo/ | 5fbe688a4f80 | brotli | 1.2.0 | 1 |
| percona/ | 1f978ab8912e | brotli | 0:1.0.6-4.el8_10 | 1 |
| pnnlmiscscripts/ | 155131891741 | brotli | 0:1.0.6-4.el8_10 | 1 |
| pnnlmiscscripts/ | 8af4b7551d40 | brotli | 0:1.0.6-4.el8_10 | 1 |
| razzy10/ | 702e411956db | brotli | 0:1.0.9-9.el9_7 | 1 |
| rm3l/ | 9a7f732245a3 | brotli | 0:1.0.9-9.el9_7 | 1 |
| rm3l/ | 3a5e1f95c132 | brotli | 0:1.0.6-4.el8_10 | 1 |
| sarwansharma/ | 59d1da9385d1 | brotli | 0:1.0.6-4.el8_10 | 1 |
| searx/ | 3dbb3a6d9419 | brotli | 1.2.0 | 1 |
| seldonio/ | 4e985d2006a8 | brotli | 0:1.0.6-4.el8_10 | 1 |
| semaphoreui/ | 5b50bc11833f | brotli | 1.2.0 | 1 |
| sigma2as/ | c284ead9ec3e | brotli | 0:1.0.6-4.el8_10 | 1 |
| sonatype/ | 586060431b64 | brotli | 0:1.0.6-4.el8_10 | 1 |
| splunk/ | c4e0d3146226 | brotli | 0:1.0.6-4.el8_10 | 1 |
| stakater/ | 97bf456cc97c | brotli | 0:1.0.6-4.el8_10 | 1 |
| trinodb/ | 6af989b0846d | brotli | 0:1.1.0-7.el10_1 | 1 |