CVE-2024-3572
published 2024-04-16CVE-2024-3572: The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without…
PriorityP341high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
0.81%
53.3th percentile
The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-scrapy | < python-scrapy 2.11.1-1 (forky) | python-scrapy 2.11.1-1 (forky) |
| scrapy | scrapy | < 2.11.1 | 2.11.1 |
| scrapy | scrapy | >= 0 < 1.8.4 | 1.8.4 |
| scrapy | scrapy | >= 2.0.0 < 2.11.1 | 2.11.1 |
| scrapy | scrapy_scrapy | >= unspecified < 2.11.1 | 2.11.1 |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_ubuntu5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Scrapy vulnerabilities
vendor_ubuntu·2025-05-05·CVSS 5.7
CVE-2024-3574 [MEDIUM] Scrapy vulnerabilities
Title: Scrapy vulnerabilities
Summary: Several security issues were fixed in python-scrapy.
It was discovered that Scrapy improperly exposed HTTP authentication
credentials to request targets, including during redirects. An attacker
could use this issue to gain unauthorized access to user accounts. This
issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-41125)
It was discovered that Scrapy did not remove the cookie header during
cross-domain redirects. An attacker could possibly use this issue to gain
unauthorized access to user accounts. This issue only affected Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-0577)
It was discovered that Scrapy inefficiently parsed XML content. An
attacker could use this issue to cause a denial of service by sendi
Debian
CVE-2024-3572: python-scrapy - The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due...
vendor_debian·2024·CVSS 7.5
CVE-2024-3572 [HIGH] CVE-2024-3572: python-scrapy - The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due...
The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 2.11.1-1)
sid: resolved (fixed in 2.11.1-1)
trixie: resolved (fixed in 2.11.1-1)
OSV
python-scrapy vulnerabilities
osv·2025-05-05·CVSS 6.5
CVE-2021-41125 [MEDIUM] python-scrapy vulnerabilities
python-scrapy vulnerabilities
It was discovered that Scrapy improperly exposed HTTP authentication
credentials to request targets, including during redirects. An attacker
could use this issue to gain unauthorized access to user accounts. This
issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-41125)
It was discovered that Scrapy did not remove the cookie header during
cross-domain redirects. An attacker could possibly use this issue to gain
unauthorized access to user accounts. This issue only affected Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-0577)
It was discovered that Scrapy inefficiently parsed XML content. An
attacker could use this issue to cause a denial of service by sending a
crafted XML response. This issue only affected Ubuntu 18.0
OSV
CVE-2024-3572: The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml
osv·2024-04-16·CVSS 7.5
CVE-2024-3572 [HIGH] CVE-2024-3572: The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml
The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This vulnerability allows attackers to perform denial of service attacks, access local files, generate network connections, or circumvent firewalls by submitting specially crafted XML data.
GHSA
Scrapy decompression bomb vulnerability
ghsa·2024-02-16
CVE-2024-3572 [HIGH] CWE-409 Scrapy decompression bomb vulnerability
Scrapy decompression bomb vulnerability
### Impact
Scrapy limits allowed response sizes by default through the [`DOWNLOAD_MAXSIZE`](https://docs.scrapy.org/en/latest/topics/settings.html#download-maxsize) and [`DOWNLOAD_WARNSIZE`](https://docs.scrapy.org/en/latest/topics/settings.html#download-warnsize) settings.
However, those limits were only being enforced during the download of the raw, usually-compressed response bodies, and not during decompression, making Scrapy vulnerable to [decompression bombs](https://cwe.mitre.org/data/definitions/409.html).
A malicious website being scraped could send a small response that, on decompression, could exhaust the memory available to the Scrapy process, potentially affecting any other process sharing that memory, and affecting disk usage in cas
OSV
Scrapy decompression bomb vulnerability
osv·2024-02-16
CVE-2024-3572 [HIGH] Scrapy decompression bomb vulnerability
Scrapy decompression bomb vulnerability
### Impact
Scrapy limits allowed response sizes by default through the [`DOWNLOAD_MAXSIZE`](https://docs.scrapy.org/en/latest/topics/settings.html#download-maxsize) and [`DOWNLOAD_WARNSIZE`](https://docs.scrapy.org/en/latest/topics/settings.html#download-warnsize) settings.
However, those limits were only being enforced during the download of the raw, usually-compressed response bodies, and not during decompression, making Scrapy vulnerable to [decompression bombs](https://cwe.mitre.org/data/definitions/409.html).
A malicious website being scraped could send a small response that, on decompression, could exhaust the memory available to the Scrapy process, potentially affecting any other process sharing that memory, and affecting disk usage in cas
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-04-16
Published