CVE-2024-1892
published 2024-02-28CVE-2024-1892: A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML…
PriorityP429medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.55%
42.8th percentile
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-scrapy | < python-scrapy 2.11.1-1 (forky) | python-scrapy 2.11.1-1 (forky) |
| scrapy | scrapy | < 2.11.1 | 2.11.1 |
| scrapy | scrapy | >= 0 < 1.8.4 | 1.8.4 |
| scrapy | scrapy | >= 2 < 2.11.1 | 2.11.1 |
| scrapy | scrapy_scrapy | >= unspecified < 2.11 | 2.11 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_ubuntu5.7MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Scrapy vulnerabilities
vendor_ubuntu·2025-05-05·CVSS 5.7
CVE-2024-3574 [MEDIUM] Scrapy vulnerabilities
Title: Scrapy vulnerabilities
Summary: Several security issues were fixed in python-scrapy.
It was discovered that Scrapy improperly exposed HTTP authentication
credentials to request targets, including during redirects. An attacker
could use this issue to gain unauthorized access to user accounts. This
issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-41125)
It was discovered that Scrapy did not remove the cookie header during
cross-domain redirects. An attacker could possibly use this issue to gain
unauthorized access to user accounts. This issue only affected Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-0577)
It was discovered that Scrapy inefficiently parsed XML content. An
attacker could use this issue to cause a denial of service by sendi
Red Hat
kernel: drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
vendor_redhat·2024-05-01·CVSS 5.5
CVE-2024-27044 [MEDIUM] kernel: drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
kernel: drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
The 'stream' pointer is used in dcn10_set_output_transfer_func() before
the check if 'stream' is NULL.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn10/dcn10_hwseq.c:1892 dcn10_set_output_transfer_func() warn: variable dereferenced before check 'stream' (see line 1875)
Potential NULL pointer dereferences in the Linux kernel in drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c. This may lead to a crash.
Statement: Red Hat Enterprise Linux 8 and 9 are not affected by this vulnerability.
Package: kerne
Debian
CVE-2024-1892: python-scrapy - A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFe...
vendor_debian·2024·CVSS 6.5
CVE-2024-1892 [MEDIUM] CVE-2024-1892: python-scrapy - A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFe...
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 2.11.1-1)
sid: resolved (fixed in 2.11.1-1)
trixie: resolved (fixed in 2.11.1-1)
OSV
python-scrapy vulnerabilities
osv·2025-05-05·CVSS 6.5
CVE-2021-41125 [MEDIUM] python-scrapy vulnerabilities
python-scrapy vulnerabilities
It was discovered that Scrapy improperly exposed HTTP authentication
credentials to request targets, including during redirects. An attacker
could use this issue to gain unauthorized access to user accounts. This
issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-41125)
It was discovered that Scrapy did not remove the cookie header during
cross-domain redirects. An attacker could possibly use this issue to gain
unauthorized access to user accounts. This issue only affected Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-0577)
It was discovered that Scrapy inefficiently parsed XML content. An
attacker could use this issue to cause a denial of service by sending a
crafted XML response. This issue only affected Ubuntu 18.0
OSV
CVE-2024-1892: A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsi
osv·2024-02-28·CVSS 6.5
CVE-2024-1892 [MEDIUM] CVE-2024-1892: A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsi
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.
GHSA
Scrapy vulnerable to ReDoS via XMLFeedSpider
ghsa·2024-02-15
CVE-2024-1892 [HIGH] CWE-1333 Scrapy vulnerable to ReDoS via XMLFeedSpider
Scrapy vulnerable to ReDoS via XMLFeedSpider
### Impact
The following parts of the Scrapy API were found to be vulnerable to a [ReDoS attack](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS):
- The [`XMLFeedSpider`](https://docs.scrapy.org/en/latest/topics/spiders.html#scrapy.spiders.XMLFeedSpider) class or any subclass that uses the default node iterator: `iternodes`, as well as direct uses of the `scrapy.utils.iterators.xmliter` function.
- **Scrapy 2.6.0 to 2.11.0**: The [`open_in_browser`](https://docs.scrapy.org/en/latest/topics/debug.html#scrapy.utils.response.open_in_browser) function for a response without a [base tag](https://www.w3schools.com/tags/tag_base.asp).
Handling a malicious response could cause extreme CPU and memory usage during
OSV
Scrapy vulnerable to ReDoS via XMLFeedSpider
osv·2024-02-15
CVE-2024-1892 [HIGH] Scrapy vulnerable to ReDoS via XMLFeedSpider
Scrapy vulnerable to ReDoS via XMLFeedSpider
### Impact
The following parts of the Scrapy API were found to be vulnerable to a [ReDoS attack](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS):
- The [`XMLFeedSpider`](https://docs.scrapy.org/en/latest/topics/spiders.html#scrapy.spiders.XMLFeedSpider) class or any subclass that uses the default node iterator: `iternodes`, as well as direct uses of the `scrapy.utils.iterators.xmliter` function.
- **Scrapy 2.6.0 to 2.11.0**: The [`open_in_browser`](https://docs.scrapy.org/en/latest/topics/debug.html#scrapy.utils.response.open_in_browser) function for a response without a [base tag](https://www.w3schools.com/tags/tag_base.asp).
Handling a malicious response could cause extreme CPU and memory usage during
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-02-28
Published