Threats tagged 'ghsa-2qfp-q593-8484'

Scrapy versions up to 2.13.3 are vulnerable to a denial of service (DoS) attack due to a flaw in the brotli decompression implementation. The existing protection against decompression bombs does not mitigate the brotli variant, allowing remote servers to cause excessive memory consumption and crash clients with less than 80GB of available memory. This vulnerability is addressed by security enhancements introduced in brotli version 1.2.0 and Scrapy version 2.13.4.