{"id":"CVE-2024-1892","aliases":["DEBIAN-CVE-2024-1892","EUVD-2024-0162","GHSA-cc65-xxvf-f7r9","PYSEC-2024-162","UBUNTU-CVE-2024-1892","USN-7476-1","openSUSE-SU-2024:13802-1"],"status":"published","title":"ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider","description":"A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00553,"percentile":0.46437,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2024-02-15T15:22:02Z","modified":"2026-11-02T12:00:55Z","fixes":[{"ecosystem":"PyPI","package":"scrapy","fixed_in":["2.11.1","1.8.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"python-scrapy","fixed_in":["2.11.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-scrapy","fixed_in":["2.11.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-scrapy","fixed_in":["1.5.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-scrapy","fixed_in":["1.7.3-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-scrapy","fixed_in":["2.5.1-2ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2"},{"fixed":"2.11.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.0-1","2.11.0-1","2.11.0-2","2.11.1-1","2.11.1-2","2.11.2-1","2.11.2-2","2.11.2-3","2.12.0-1","2.12.0-2","2.13.1-1~exp1","2.13.3-1","2.13.3-1~exp1","2.13.4-1","2.13.4-2","2.14.0-1","2.14.1-1","2.14.2-1","2.15.1-1","2.16.0-1","2.16.0-2","2.17.0-1","2.18.0-1","2.18.0-2","2.19.0-1","2.19.0-2","2.8.0-2","2.9.0-1","2.9.0-1~exp1","2.9.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2"},{"fixed":"2.11.1"}]}],"versions":["2.0.0","2.0.1","2.1.0","2.10.0","2.10.1","2.11.0","2.2.0","2.2.1","2.3.0","2.4.0","2.4.1","2.5.0","2.5.1","2.6.0","2.6.1","2.6.2","2.6.3","2.7.0","2.7.1","2.8.0","2.9.0"]},{"source":"osv","ecosystem":"PyPI","package":"scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4"}]}],"versions":["0.10.4.2364","0.12.0.2550","0.14.1","0.14.2","0.14.3","0.14.4","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.16.5","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.20.0","0.20.1","0.20.2","0.22.0","0.22.1","0.22.2","0.24.0","0.24.1","0.24.2","0.24.3","0.24.4","0.24.5","0.24.6","0.7","0.8","0.9","1.0.0","1.0.0rc1","1.0.0rc2","1.0.0rc3","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.0rc1","1.1.0rc2","1.1.0rc3","1.1.0rc4","1.1.1","1.1.2","1.1.3","1.1.4","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.5.0","1.5.1","1.5.2","1.6.0","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.8.0","1.8.1","1.8.2","1.8.3"]},{"source":"osv","ecosystem":"PyPI","package":"scrapy","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"479619b340f197a8f24c5db45bc068fb8755f2c5"},{"fixed":"479619b340f197a8f24c5db45bc068fb8755f2c5"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1"}]}],"versions":["0.10.4.2364","0.12.0.2550","0.14.1","0.14.2","0.14.3","0.14.4","0.16.0","0.16.1","0.16.2","0.16.3","0.16.4","0.16.5","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.20.0","0.20.1","0.20.2","0.22.0","0.22.1","0.22.2","0.24.0","0.24.1","0.24.2","0.24.3","0.24.4","0.24.5","0.24.6","0.7","0.8","0.9","1.0.0","1.0.0rc1","1.0.0rc2","1.0.0rc3","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.1.0","1.1.0rc1","1.1.0rc2","1.1.0rc3","1.1.0rc4","1.1.1","1.1.2","1.1.3","1.1.4","1.2.0","1.2.1","1.2.2","1.2.3","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.5.0","1.5.1","1.5.2","1.6.0","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","2.0.0","2.0.1","2.1.0","2.10.0","2.10.1","2.11.0","2.2.0","2.2.1","2.3.0","2.4.0","2.4.1","2.5.0","2.5.1","2.6.0","2.6.1","2.6.2","2.6.3","2.7.0","2.7.1","2.8.0","2.9.0","1.2.0dev2","scrapy-0.25.1-sc","hojo","0.25.1","0.25.0","0.23.0","0.21.0","0.17.0","0.15.1","0.14.0","0.15.0","0.10.3","0.10.2","0.10.1","0.10","0.10-rc1","0.9-rc1","0.7-rc1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0-1","1.0.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1ubuntu0.1~esm1"}]}],"versions":["1.3.0-1~exp2","1.4.0-1","1.5.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.3-1ubuntu0.1~esm1"}]}],"versions":["1.7.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-2ubuntu0.1~esm1"}]}],"versions":["2.4.1-2","2.5.1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1ubuntu0.1~esm1"}]}],"versions":["1.3.0-1~exp2","1.4.0-1","1.5.0-1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.3-1ubuntu0.1~esm1"}]}],"versions":["1.7.3-1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-2ubuntu0.1~esm1"}]}],"versions":["2.4.1-2","2.5.1-2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-scrapy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1-1ubuntu0.1~esm2"}]}],"versions":["2.10.0-1","2.11.0-1","2.11.0-2","2.11.1-1"],"bundled":6}],"products":[{"vendor":"scrapy","product":"scrapy"},{"vendor":"scrapy","product":"scrapy/scrapy"}],"references":[{"url":"https://huntr.com/bounties/271f94f2-1e05-4616-ac43-41752389e26b","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","web","evidence","fix","report"]},{"url":"https://github.com/scrapy/scrapy/commit/479619b340f197a8f24c5db45bc068fb8755f2c5","tags":["x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/scrapy/scrapy/security/advisories/GHSA-cc65-xxvf-f7r9","tags":["web"]},{"url":"https://docs.scrapy.org/en/latest/news.html#scrapy-1-8-4-2024-02-14","tags":["web"]},{"url":"https://docs.scrapy.org/en/latest/news.html#scrapy-2-11-1-2024-02-14","tags":["web"]},{"url":"https://github.com/scrapy/scrapy/commit/73e7c0ed011a0565a1584b8052ec757b54e5270b","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/scrapy/PYSEC-2024-162.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cc65-xxvf-f7r9","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1892.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1892","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-1892","tags":["advisory"]},{"url":"https://github.com/scrapy/scrapy","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-1892","tags":["report"]},{"url":"https://huntr.com/bounties/271f94f2-1e05-4616-ac43-41752389e26b/","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1892","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7476-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-41125","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-0577","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-1968","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-3572","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-3574","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-1892","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-1892","title":"ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider","description":"A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.","status":"published","published":"2024-02-28T00:00:14.092Z","modified":"2024-08-11T14:28:49.917Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:34:18.259965Z"}],"euvd":[{"id":"EUVD-2024-0162","description":"A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.","status":"published","published":"2024-02-28T00:00:14Z","modified":"2024-08-11T14:28:49Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:56:20.709797Z"}],"ghsa":[{"id":"GHSA-cc65-xxvf-f7r9","title":"Scrapy vulnerable to ReDoS via XMLFeedSpider","description":"### Impact\n\nThe following parts of the Scrapy API were found to be vulnerable to a [ReDoS attack](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS):\n\n- The [`XMLFeedSpider`](https://docs.scrapy.org/en/latest/topics/spiders.html#scrapy.spiders.XMLFeedSpider) class or any subclass that uses the default node iterator: `iternodes`, as well as direct uses of the `scrapy.utils.iterators.xmliter` function.\n\n- **Scrapy 2.6.0 to 2.11.0**: The [`open_in_browser`](https://docs.scrapy.org/en/latest/topics/debug.html#scrapy.utils.response.open_in_browser) function for a response without a [base tag](https://www.w3schools.com/tags/tag_base.asp). \n\nHandling a malicious response could cause extreme CPU and memory usage during the parsing of its content, due to the use of vulnerable regular expressions for that parsing.\n\n### Patches\n\nUpgrade to Scrapy 2.11.1.\n\nIf you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.11.1 is not an option, you may upgrade to Scrapy 1.8.4 instead.\n\n### Workarounds\n\nFor `XMLFeedSpider`, switch the node iterator to ``xml`` or ``html``.\n\nFor `open_in_browser`, before using the function, either manually review the response content to discard a ReDos attack or manually define the base tag to avoid its automatic definition by `open_in_browser` later.\n\n### Acknowledgements\n\nThis security issue was reported by @nicecatch2000  [through huntr.com](https://huntr.com/bounties/271f94f2-1e05-4616-ac43-41752389e26b/).\n","status":"published","published":"2024-02-15T15:22:02Z","modified":"2026-03-16T05:04:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:39:36.642723Z"}],"nvd":[{"id":"CVE-2024-1892","description":"A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.","status":"published","published":"2024-02-28T00:15:53.897Z","modified":"2026-06-17T07:05:14.03Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:09:38.473056Z"}],"osv":[{"id":"CVE-2024-1892","title":"ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider","description":"A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.","status":"published","published":"2024-02-28T00:00:14.092Z","modified":"2026-10-28T02:31:13.826676076Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DEBIAN-CVE-2024-1892","description":"A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.","status":"published","published":"2024-02-28T00:15:53.897Z","modified":"2026-11-02T12:00:55.271271353Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"GHSA-cc65-xxvf-f7r9","title":"Scrapy vulnerable to ReDoS via XMLFeedSpider","description":"### Impact\n\nThe following parts of the Scrapy API were found to be vulnerable to a [ReDoS attack](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS):\n\n- The [`XMLFeedSpider`](https://docs.scrapy.org/en/latest/topics/spiders.html#scrapy.spiders.XMLFeedSpider) class or any subclass that uses the default node iterator: `iternodes`, as well as direct uses of the `scrapy.utils.iterators.xmliter` function.\n\n- **Scrapy 2.6.0 to 2.11.0**: The [`open_in_browser`](https://docs.scrapy.org/en/latest/topics/debug.html#scrapy.utils.response.open_in_browser) function for a response without a [base tag](https://www.w3schools.com/tags/tag_base.asp). \n\nHandling a malicious response could cause extreme CPU and memory usage during the parsing of its content, due to the use of vulnerable regular expressions for that parsing.\n\n### Patches\n\nUpgrade to Scrapy 2.11.1.\n\nIf you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.11.1 is not an option, you may upgrade to Scrapy 1.8.4 instead.\n\n### Workarounds\n\nFor `XMLFeedSpider`, switch the node iterator to ``xml`` or ``html``.\n\nFor `open_in_browser`, before using the function, either manually review the response content to discard a ReDos attack or manually define the base tag to avoid its automatic definition by `open_in_browser` later.\n\n### Acknowledgements\n\nThis security issue was reported by @nicecatch2000  [through huntr.com](https://huntr.com/bounties/271f94f2-1e05-4616-ac43-41752389e26b/).\n","status":"published","published":"2024-02-15T15:22:02Z","modified":"2025-01-14T17:20:10.367591Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"PYSEC-2024-162","description":"A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.","status":"published","published":"2024-02-28T00:15:53Z","modified":"2026-06-10T17:02:40.004499262Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:53.837392Z"},{"id":"UBUNTU-CVE-2024-1892","description":"A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.","status":"published","published":"2024-02-28T00:15:00Z","modified":"2026-02-05T02:14:42.657075Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"openSUSE-SU-2024:13802-1","title":"python-Scrapy-doc-2.11.1-1.1 on GA media","description":"These are all security issues fixed in the python-Scrapy-doc-2.11.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:19:21.227965Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"USN-7476-1","title":"python-scrapy vulnerabilities","description":"It was discovered that Scrapy improperly exposed HTTP authentication \ncredentials to request targets, including during redirects. An attacker \ncould use this issue to gain unauthorized access to user accounts. This\nissue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-41125)\n\nIt was discovered that Scrapy did not remove the cookie header during\ncross-domain redirects. An attacker could possibly use this issue to gain\nunauthorized access to user accounts. This issue only affected Ubuntu 18.04\nLTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-0577)\n\nIt was discovered that Scrapy inefficiently parsed XML content. An\nattacker could use this issue to cause a denial of service by sending a\ncrafted XML response. This issue only affected Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2024-1892)\n\nIt was discovered that Scrapy did not properly check response size during\ndecompression. An attacker could send a crafted response that would\nexhaust memory and cause a denial of service. This issue only affected\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2024-3572)\n\nIt was discovered that Scrapy did not remove the authorization header\nduring cross-domain redirects. An attacker could possibly use this issue\nto gain unauthorized access to user accounts. This issue only affected \nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2024-3574)\n\nIt was discovered that Scrapy did not remove the authorization header\nduring redirects that change scheme but remain in the same domain. This\nissue could possibly be used by an attacker to expose sensitive \ninformation or to gain unauthorized access to user accounts.\n(CVE-2024-1968)\n\n","status":"published","published":"2025-05-05T16:31:52Z","modified":"2026-04-27T18:02:20.75951352Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}