Listen to this Post
The vulnerability, CVE-2025-21135, is a decompression bomb attack targeting the Brotli compression algorithm. An attacker can craft a small, malicious Brotli archive designed to decompress into an enormous amount of data, specifically by using highly compressible patterns like long sequences of zeros. The Brotli algorithm’s extreme compression ratio for such data means a file only a few megabytes in size can request over 80 gigabytes of memory upon decompression. This overwhelms the system’s available memory, causing it to become unresponsive or crash, resulting in a Denial-of-Service condition. This flaw is particularly critical in client applications, such as Scrapy, where a remote server can send this malicious archive to a vulnerable client, consuming its resources and crashing it.
Platform: Brotli Library
Version: <= 1.1.0
Vulnerability: Decompression Bomb
Severity: High
date: 2025-10-31
Prediction: Patch available
What Undercode Say:
Simulating a request with a brotli-encoded payload curl -H "Content-Encoding: br" http://target.com --data-binary @malicious.br Checking brotli version in a system ldconfig -p | grep brotli
Example Scrapy client making a vulnerable request import scrapy class VulnerableSpider(scrapy.Spider): name = 'test' def start_requests(self): A request to a malicious server could trigger the CVE yield scrapy.Request(url='http://malicious-server.com/data.br', callback=self.parse) def parse(self, response): Decompression happens here, consuming excessive memory data = response.body
How Exploit:
Create a small Brotli file containing highly repetitive data (e.g., zeros), host it on a server, and trick a vulnerable client into requesting and decompressing it.
Protection from this CVE
Upgrade to Brotli 1.2.0. For Scrapy, update beyond version 2.13.2. Implement client-side limits on decompressed data size and monitor memory usage during decompression processes.
Impact:
Client application crash, excessive memory consumption, remote denial-of-service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
