Improper Resource Shutdown or Release Affecting scrapy package, versions [,1.8.4) [2.0.0,2.11.1)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-SCRAPY-6252661
- published 19 Feb 2024
- disclosed 16 Feb 2024
- credit dmandefy
Introduced: 16 Feb 2024
CVE-2024-3572 Open this link in a new tabHow to fix?
Upgrade Scrapy to version 1.8.4, 2.11.1 or higher.
Overview
Scrapy is a high-level web crawling and web scraping framework, used to crawl websites and extract structured data from their pages.
Affected versions of this package are vulnerable to Improper Resource Shutdown or Release due to the enforcement of response size limits only during the download of raw, usually-compressed response bodies and not during decompression. A malicious website being scraped could send a small response that, upon decompression, could exhaust the memory available to the process, potentially affecting any other process sharing that memory, and affecting disk usage in case of uncompressed response caching.