StackRadar

CVE-2025-6176

High

Advisory

Published 31 Oct 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
41st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
255
of 17,781 indexed, latest versions
Container images
287
deployed by those charts
Fix available
2 of 2
affected packages

Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation

Carried by container images the latest versions of 255 of 17,781 indexed charts deploy, on 287 images.

Affected packageAffected versionsFixed inImages
brotlirpm1.0.6-1.el8, 1.0.6-2.el8, 1.0.6-3.el8, 1.0.9-6.el9+2 more0:1.0.6-4.el8_10, 0:1.0.9-9.el9_7, 0:1.1.0-7.el10_1238
brotlipypi1.0.9, 1.1.01.2.049
OSV records
GHSA-2qfp-q593-8484RHSA-2026:0845RHSA-2026:2042RHSA-2026:2389RLSA-2026:2042
Also known as
PYSEC-2026-1906, PYSEC-2026-2401, RHSA-2026:2227, RHSA-2026:2228, RHSA-2026:2229, RHSA-2026:2399, RHSA-2026:2400, RHSA-2026:2401, RHSA-2026:2455

Charts affected

255 by stars
ChartLatestAffected imagesRadar Score
minio-standalonewenerme1.0.21 of 1See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2025-6176.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2022-01-04T07-41-07Z1484c87239ea
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10

Open the chart page →

6,138
wexa-studiowexa-studio1.2.01 of 15See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2025-6176.

Container imageDigestPackageFixed in
quay.io/mongodb/mongodb-kubernetes-operator:0.9.05ee4bd681085
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10

Open the chart page →

14,983
workshop-pipelinesworkshop-pipelines0.1.61 of 2See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2025-6176.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10

Open the chart page →

11,577
keycloakxzaks2.2.01 of 1See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2025-6176.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:20.0.3b8f2a453a17a
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10

Open the chart page →

6,016
posthogzeet0.23.21 of 9See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2025-6176.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.19.07a85f522c5bc
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10

Open the chart page →

3,697

Container images carrying it

287 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
viniciusfcf/gitops-quarkus-app-jvm:latestbba8ee1b5cd5
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
vividplanet/swr-cache-proxy:v1ae1c5b1cbecb
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
ghcr.io/ctron/ditto-operator:0.4.061a9bb81b85c
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
ghcr.io/ctron/kubectl:1.25e37d61b5277c
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
ghcr.io/ctron/streamsheets-base:2.4.00cf25ed621e2
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
ghcr.io/dask/dask:2024.1.0080150de7d86
brotli@1.1.0
1.2.0
1
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
brotli@1.1.0
1.2.0
1
ghcr.io/devops-ia/cp-schema-registry:8.1.1-msk-iam-auth2.3.530d1a445acc7
brotli@1.0.9-7.el9_5
0:1.0.9-9.el9_7
1
ghcr.io/drogue-iot/drogue-event-source:0.2.1e2e812a4cf8e
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
ghcr.io/drogue-iot/postgresql-pusher:0.2.1c6bb121ced90
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
ghcr.io/drogue-iot/test-cert-generator:0.11.06ba7e1608286
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
ghcr.io/gabe565/obico/web:latesta5c1daef46c0
brotli@1.1.0
1.2.0
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
brotli@1.1.0
1.2.0
1
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
brotli@1.0.9
1.2.0
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
brotli@1.1.0
1.2.0
1
ghcr.io/jenkins-x/nexus:0.1.378caf5289fe73
brotli@1.0.6-1.el8
0:1.0.6-4.el8_10
1
ghcr.io/k8snetworkplumbingwg/multus-dynamic-networks-controller:v0.3.72a2bb32c0ea8
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
brotli@1.1.0
1.2.0
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
brotli@1.1.0
1.2.0
1
ghcr.io/kluster-manager/managed-serviceaccount:latest365183f83ac9
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
ghcr.io/kluster-manager/multicluster-controlplane:latest6de40f528be9
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
ghcr.io/linuxforhealth/fhir-schematool:5.1.1f62cefee6ef6
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
ghcr.io/m0nsterrr/hyperglass:v2.0.4f7b5d20c5e42
brotli@1.1.0
1.2.0
1
ghcr.io/microboxlabs/miot-calendar:latest-jvm7157cdc0bf5b
brotli@1.0.9-7.el9_5
0:1.0.9-9.el9_7
1
ghcr.io/microboxlabs/miot-srv:latest4ec11d229028
brotli@1.0.9-7.el9_5
0:1.0.9-9.el9_7
1
ghcr.io/microboxlabs/miot-srv:latest5796553b41ae
brotli@1.0.9-7.el9_5
0:1.0.9-9.el9_7
1
ghcr.io/mirio/verbacap:v1.5.084928e2fc4f2
brotli@1.1.0
1.2.0
1
ghcr.io/open-telemetry/demo:1.12.0-loadgenerator85c9935ff31b
brotli@1.1.0
1.2.0
1
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
brotli@1.1.0
1.2.0
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
brotli@1.1.0
1.2.0
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
brotli@1.1.0
1.2.0
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
brotli@1.1.0
1.2.0
1
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
brotli@1.1.0
1.2.0
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
brotli@1.1.0
1.2.0
1
ghcr.io/smarter-project/audio-client:v3.1.23c8375dc5487
brotli@1.0.9
1.2.0
1
ghcr.io/smarter-project/image-detector:v2.5.31dcca70c6446
brotli@1.0.9
1.2.0
1
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.0-1-ubi99026dbbf280d
brotli@1.0.9-7.el9_5
0:1.0.9-9.el9_7
1
public.ecr.aws/perfectscale-io/kube-state-metrics:4.1.14-redhat849e235e2d3e
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
public.ecr.aws/v0r6c2e2/hive-metastore:latest794b3bff9510
brotli@1.0.9-6.el9
0:1.0.9-9.el9_7
1
quay.io/ai-lab/llamacpp_python:latest70d138997acd
brotli@1.0.9-6.el9
0:1.0.9-9.el9_7
1
quay.io/ansible/awx-operator:2.19.17302e0c8e5a7
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
quay.io/apicurio/apicurio-registry-mem:2.5.8.Final3b036692d546
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
quay.io/backube/scribe:0.2.0cdefc81c6b2e
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1
quay.io/eclipse/che-operator:7.122.0d752a1c2a7b7
brotli@1.0.6-3.el8
0:1.0.6-4.el8_10
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.