Threat database

CVE-2026-55520 is a high-severity vulnerability in the Protego library, a Python robots.txt parser used by the Scrapy project. Versions prior to 0.6.2 are affected by uncontrolled resource consumption due to exponential backtracking in regular expression matching when processing robots.txt directives containing many asterisks. This can cause denial of service by making the can_fetch method spend an attacker-controlled amount of time matching URLs. The issue is fixed in version 0.6.2.

Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.