-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| scrapy | pip | >= 2.0.0, < 2.11.1 | 2.11.1 |
| scrapy | pip | < 1.8.4 | 1.8.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from decompression handling without size validation. Key functions identified through the patch analysis include: 1) HttpCompressionMiddleware's _decode method which directly handled decompression without size checks, 2) The core gunzip utility function that lacked size monitoring, and 3) SitemapSpider's XML processing that decompressed content without limits. The commit adds max_size parameters and decompression bomb checks to all these areas, confirming they were previously vulnerable.
Ongoing coverage of React2Shell