Critical Security Update for Brotli: Addressing Python Decompression Bomb Vulnerability
Summary
ALSA-2026:2042: Important: brotli security update. Affects brotli versions < 1.0.9-9.el9_7. Fixed in 1.0.9-9.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Brotli is a versatile lossless compression algorithm designed to compress data efficiently using a combination of modern LZ77, Huffman coding, and context modeling. It is known for achieving a high compression ratio while maintaining speed comparable to other methods like deflate. The algorithm is widely used in web applications and data storage solutions. However, it has been found vulnerable to a decompression bomb denial-of-service (DoS) attack, which can exploit the decompression process to consume excessive resources.
Vulnerability Detail
The vulnerability identified as CVE-2025-6176 pertains to a decompression bomb in the Brotli implementation within Python's Scrapy framework. This vulnerability allows an attacker to craft a specially designed compressed file that, when decompressed, can lead to resource exhaustion on the server, potentially causing a denial of service. The issue arises from the way Brotli handles decompression, which can lead to excessive memory and CPU usage, impacting the availability of the affected service.
How To Fix
Minimum fixed version
1.0.9-9.el9_7
This is the first release that contains the fix.
sudo dnf update brotliTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the size of the compressed files that your application processes or implement checks to validate the integrity and size of incoming compressed data before decompression. This can help mitigate the risk of a decompression bomb attack.
Conclusion
The Brotli compression algorithm has a critical vulnerability that can lead to denial of service through decompression bombs. It is crucial for users of the affected packages to update to the patched version to safeguard their applications. Implementing workarounds can provide temporary relief while updates are being applied.
See every vulnerability recorded for brotli →
FAQ
A decompression bomb is a maliciously crafted compressed file that expands to a significantly larger size when decompressed, consuming excessive system resources and potentially leading to denial of service.
If your application uses the affected Brotli packages, it may be susceptible to denial of service attacks, which can disrupt service availability and degrade performance.
If immediate updates are not possible, consider implementing size limits on compressed files and validating their integrity before processing to reduce the risk of exploitation.
Detailed information about this vulnerability can be found on the CVE page for CVE-2025-6176, which includes technical details and impact assessments.
Vulert provides a service that monitors open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for brotli.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
