Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
XMLFeedSpider Regular Expressions Cause CPU and Memory Overload
published 2 years ago
Summary
XMLFeedSpider's parsing function can be exploited by malicious data, leading to extreme CPU and memory usage. This can slow down or even crash the system. To fix this, update to the latest version of XMLFeedSpider.
What to do
- Update scrapy developers scrapy to version 2.11.1.
- Update scrapy developers scrapy to version 1.8.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | scrapy developers | scrapy |
>= 2, < 2.11.1 < 1.8.4 Fix: upgrade to 2.11.1
|
Original advisory text
Duplicate Advisory: ReDos vulnerability of XMLFeedSpider
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-cc65-xxvf-f7r9. This link is maintained to preserve external references.
## Original Description
Parts of the Scrapy API were found to be vulnerable to a ReDoS attack. Handling a malicious response could cause extreme CPU and memory usage during the parsing of its content, due to the use of vulnerable regular expressions for that parsing.
This advisory has been withdrawn because it is a duplicate of GHSA-cc65-xxvf-f7r9. This link is maintained to preserve external references.
## Original Description
Parts of the Scrapy API were found to be vulnerable to a ReDoS attack. Handling a malicious response could cause extreme CPU and memory usage during the parsing of its content, due to the use of vulnerable regular expressions for that parsing.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-1333Inefficient Regular Expression Complexity (ReDoS)
Timeline
Published28 Feb 2024
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-7c9g-vj9m-8pm6 · GHSA
Track software like this
Free during beta