p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de python-scrapy

Vulnérabilités publiées pour python-scrapy au cours des 30 derniers jours : 1. Présentes dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 3

  1. CVE-2026-105782

    Élevée · CVSS 7.5EPSS 0,38%Aucun correctif publié

    Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware

    Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler processing the response. This issue is fixed in version 2.14.2.

    python-scrapySystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2025-6176

    Élevée · CVSS 7.5EPSS 0,55%Aucun correctif publié

    Brotli decompression bomb DoS in scrapy/scrapy

    Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.

    python-scrapySystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  3. CVE-2017-14158

    Élevée · CVSS 7.5EPSS 2,6%Aucun correctif publié

    CVE-2017-14158

    Scrapy 1.4 allows remote attackers to cause a denial of service (memory consumption) via large files because arbitrarily many files are read into memory, which is especially problematic if the files are then individually written in a separate thread to a slow storage resource, as demonstrated by interaction between dataReceived (in core/downloader/handlers/http11.py) and S3FilesStore.

    python-scrapySystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →