A critical vulnerability in the Scrapy framework allows remote servers to trigger a denial of service attack by exhausting client memory via malformed brotli compressed data.

This is a resource consumption vulnerability (CWE-400) where the brotli decompression implementation fails to mitigate decompression bombs. An unauthenticated remote attacker can cause a client application to crash by providing highly compressed, zero-filled data that consumes excessive memory during decompression.

The ability for a remote, unauthenticated attacker to crash an application leads to significant service availability risks. Given the CVSS score of 7.5, this high-severity flaw can cause critical business disruption for organizations relying on Scrapy for automated data collection or web scraping operations, potentially resulting in prolonged downtime and loss of data throughput.

Immediate Action: Monitor official Scrapy security advisories and the GitHub repository for the release of a patch that addresses the brotli decompression flaw, and apply the update as soon as it becomes available.

Proactive Monitoring: Review application resource utilization metrics to identify unusual spikes in memory consumption that may indicate an active attempt to trigger this decompression vulnerability.

Compensating Controls: If immediate patching is not possible, implement strict limits on the size of responses processed by Scrapy or disable brotli decompression if the target services support alternative compression methods.

Public Exploit Available: Unknown

This vulnerability poses a significant risk to the stability of any environment utilizing the Scrapy framework. We recommend that security teams identify all instances of Scrapy in their production environments and prepare for an emergency update cycle as soon as the vendor releases a fix. Prioritize the implementation of resource monitoring to detect potential exploitation attempts until a permanent remediation is verified and deployed.