Scrapy vulnerabilities

Products

• Scrapy 9
• Scrapy/scrapy 6

Newest

• scrapy Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default CVE-2026-84366 Fix available 7.4 HighSeptember 1, 2026
• scrapy protego Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matching CVE-2026-55520 Fix available 7.1 HighJuly 7, 2026
• scrapy Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware CVE-2026-105782 Fix available 7.5 HighMarch 13, 2026
• scrapy scrapy/scrapy Brotli decompression bomb DoS in scrapy/scrapy CVE-2025-6176 Fix available 7.5 HighOctober 31, 2025
• scrapy, scrapy scrapy/scrapy +1 more Authorization Header Leakage in scrapy/scrapy on Scheme Change Redirects CVE-2024-1968 Fix available 7.5 HighMay 14, 2024
• scrapy, scrapy scrapy/scrapy +1 more XML External Entity (XXE) Vulnerability in scrapy/scrapy CVE-2024-3572 Fix available 7.5 HighFebruary 16, 2024
• scrapy, scrapy scrapy/scrapy +1 more Authorization Header Leak During Cross-Domain Redirect in scrapy/scrapy CVE-2024-3574 Fix available 7.5 HighFebruary 15, 2024
• scrapy, scrapy scrapy/scrapy +1 more ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider CVE-2024-1892 Fix available 7.5 HighFebruary 15, 2024
• scrapy, scrapy scrapy/scrapy, debian linux +2 more Exposure of Sensitive Information to an Unauthorized Actor in scrapy/scrapy CVE-2022-0577 Fix available 8.8 HighMarch 1, 2022
• scrapy, debian linux +1 more HTTP authentication credential leak to target websites in scrapy CVE-2021-41125 Fix available 5.7 MediumOctober 6, 2021
• scrapy Scrapy denial of service vulnerability CVE-2017-14158 7.5 HighSeptember 5, 2017