CVE-2025-6176

High

Advisory

Published 31 Oct 2025In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.005; 41st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 255; of 17,781 indexed, latest versions
Container images: 287; deployed by those charts
Fix available: 2 of 2; affected packages

Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation

Carried by container images the latest versions of 255 of 17,781 indexed charts deploy, on 287 images.

Affected package	Affected versions	Fixed in	Images
brotlirpm	1.0.6-1.el8, 1.0.6-2.el8, 1.0.6-3.el8, 1.0.9-6.el9+2 more	0:1.0.6-4.el8_10, 0:1.0.9-9.el9_7, 0:1.1.0-7.el10_1	238
brotlipypi	1.0.9, 1.1.0	1.2.0	49

OSV records: GHSA-2qfp-q593-8484 RHSA-2026:0845 RHSA-2026:2042 RHSA-2026:2389 RLSA-2026:2042
Also known as: PYSEC-2026-1906, PYSEC-2026-2401, RHSA-2026:2227, RHSA-2026:2228, RHSA-2026:2229, RHSA-2026:2399, RHSA-2026:2400, RHSA-2026:2401, RHSA-2026:2455

Charts affected

255 by stars

Chart

Latest

Affected images

Radar Score

minio-standalonewenerme

1.0.2

1 of 1 See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2025-6176.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10

Open the chart page →

6,138

wexa-studiowexa-studio

1.2.0

1 of 15 See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2025-6176.

Container image	Digest	Package	Fixed in
quay.io/mongodb/mongodb-kubernetes-operator :0.9.0	5ee4bd681085	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10

Open the chart page →

14,983

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2025-6176.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10

Open the chart page →

11,577

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2025-6176.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10

Open the chart page →

6,016

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2025-6176.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10

Open the chart page →

3,697

Container images carrying it

287 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
codeurjc/weatherservice :v1.0	b9e2f7234349	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	10
codeurjc/server :v1.0	310bea5b1ee7	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	8
mastercloudapps/server :v2.23	f3d24dfe2686	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	4
mastercloudapps/weatherservice :v1.23	de859d29c116	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	4
quay.io/strimzi/operator :0.37.0	52f376e64b9b	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	4
cloudve/cloudlaunch-server :latest	4a3d7fae90bb	brotli@1.0.9	1.2.0	3
dpage/pgadmin4 :6.12	781369df9994	brotli@1.0.9	1.2.0	3
minio/minio :RELEASE.2021-02-14T04-01-33Z	bd11edda91f3	brotli@1.0.6-2.el8	0:1.0.6-4.el8_10	3
quay.io/devtron/clair :4.3.6	75fb847ac045	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	3
quay.io/openshift/origin-oauth-proxy :4.14	a7dff785d821	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	3
quay.io/redhat-cop/kube-rbac-proxy :v0.11.0	c68135620167	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	3
apacherocketmq/rocketmq-dashboard :2.1.0	ce78506bd6fe	brotli@1.0.9-7.el9_5	0:1.0.9-9.el9_7	2
confluentinc/cp-kafka :6.2.11-1-ubi8	ac776fad95a5	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	2
confluentinc/cp-zookeeper :latest	7610a50b13e7	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	2
confluentinc/cp-zookeeper :6.2.11-1-ubi8	cae577096489	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	2
locustio/locust :2.32.2	a0d4b88e42c1	brotli@1.1.0	1.2.0	2
minio/operator :v4.3.7	54393e03f3b2	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	2
stakater/stakater-nordmart-review :1.0.35	954d2be66e95	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	2
public.ecr.aws/aktosecurity/confluentinc-cp-kafka :8.1.1-1-ubi9	d20bd62f0182	brotli@1.0.9-7.el9_5	0:1.0.9-9.el9_7	2
quay.io/flomesh/curl-ubi8 :7.84.0	bef31fa5f5f3	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	2
quay.io/keycloak/keycloak :20.0	054ef67eb7da	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	2
quay.io/keycloak/keycloak :17.0.1-legacy	68f9f38c8f30	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	2
quay.io/minio/mc :RELEASE.2023-09-29T16-41-22Z	a784ce6e3b1b	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	2
quay.io/minio/mc :RELEASE.2023-01-28T20-29-38Z	ad34abeba912	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	2
quay.io/minio/minio :RELEASE.2023-09-30T07-02-29Z	6262bc9a2730	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	2
quay.io/minio/minio :RELEASE.2023-07-21T21-12-44Z	8e5e9490cd50	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	2
quay.io/minio/minio :RELEASE.2023-02-10T18-48-39Z	a0a002cb113c	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	2
quay.io/mongodb/mongodb-kubernetes-operator :0.13.0	2dcc6393e6f7	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	2
quay.io/opencloudio/ibm-mongodb :4.0.24	d8c631a6dc43	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	2
quay.io/openshift/origin-cli :4.7	464a3af4dfe0	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	2
quay.io/openshift/origin-cli :4.8	bb5e052770e5	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	2
quay.io/strimzi/operator :0.39.0	02f6f143fc6d	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	2
akeyless/base-rhel :0.0.1	4ba8900a0061	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	1
alerta/alerta-web :8.5.0	4786b9eaa606	brotli@1.0.9	1.2.0	1
allegroai/clearml :2.0.0-613	713ae38f7daf	brotli@1.1.0	1.2.0	1
alquimiaai/studio :certification	38a1f0341982	brotli@1.0.9-7.el9_5	0:1.0.9-9.el9_7	1
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	1
altinity/clickhouse-operator :0.20.0	8f0f582d41f0	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	1
altinity/metrics-exporter :0.20.0	1a46d104406d	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	1
anchore/anchore-engine :v0.10.0	bde9eedf639d	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	1
anchore/anchore-engine :v0.7.1	ed9b3badd17c	brotli@1.0.6-1.el8	0:1.0.6-4.el8_10	1
andrianrf/backoffice :latest	047a7837651e	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	1
andrianrf/backoffice-be :latest	6036614803d4	brotli@1.0.9-6.el9	0:1.0.9-9.el9_7	1
andrianrf/iso-server :latest	7da47f525c7d	brotli@1.0.9-6.el9	0:1.0.9-9.el9_7	1
apache/camel-k :1.10.4	3bb13d14f64a	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	1
apache/superset :9cdaa280429ec297db16d56c94fd77b5d2aff107	975ab033580d	brotli@1.0.9	1.2.0	1
apache/superset :4.0.1	ab9467fd712c	brotli@1.0.9	1.2.0	1
apecloud/aperag :v0.0.0-nightly	8ac9947a2c84	brotli@1.1.0	1.2.0	1
apecloud/smartfs-csi-driver :0.1.1	ff2858eab9cc	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	1
apicurio/apicurio-registry-kafkasql :2.1.0.Final	a97d67487532	brotli@1.0.6-3.el8	0:1.0.6-4.el8_10	1