CVE-2024-1892— ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider
Possible ATT&CK Techniques 1AI
T1499 · Endpoint Denial of ServiceGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-1892
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider
Source: CVE Program / CVE List V5
Vulnerability Description
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular expression complexity used in the parsing process, an attacker can cause a denial-of-service (DoS) condition. This vulnerability allows for the system to hang and consume significant resources, potentially rendering services that utilize Scrapy for XML processing unresponsive.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1333
Source: CVE Program / CVE List V5
Vulnerability Title
Scrapy 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Scrapy是一个用Python编写的自由且开源的网络爬虫框架。 Scrapy存在安全漏洞，该漏洞源于使用易受攻击的正则表达式进行解析，处理恶意响应可能会在解析其内容期间导致极端的 CPU 和内存使用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| scrapy | scrapy/scrapy | unspecified ~ 2.11 | - |
II. Public POCs for CVE-2024-1892
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-1892
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-1892 (1)
Vendor Advisories for CVE-2024-1892 (1)
IV. Related Vulnerabilities
Same product: scrapy/scrapy
- CVE-2025-6176
Brotli decompression bomb DoS in scrapy/scrapy - CVE-2024-1968
Authorization Header Leakage in scrapy/scrapy on Scheme Chan - CVE-2024-3574
Authorization Header Leak During Cross-Domain Redirect in sc - CVE-2024-3572
XML External Entity (XXE) Vulnerability in scrapy/scrapy - CVE-2022-0577
Exposure of Sensitive Information to an Unauthorized Actor i
Same vendor: scrapy
- CVE-2025-6176
Brotli decompression bomb DoS in scrapy/scrapy - CVE-2024-1968
Authorization Header Leakage in scrapy/scrapy on Scheme Chan - CVE-2024-3574
Authorization Header Leak During Cross-Domain Redirect in sc - CVE-2024-3572
XML External Entity (XXE) Vulnerability in scrapy/scrapy - CVE-2022-0577
Exposure of Sensitive Information to an Unauthorized Actor i
Same weakness: CWE-1333
- CVE-2026-69207
Hono: ReDoS in CORS middleware via Access-Control-Request-He - CVE-2026-66062
SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthent - CVE-2026-67422
pymdown-extensions: Exponential-backtracking ReDoS in caret, - CVE-2026-68749
Quadratic regex backtracking in the html_sanitize_ex CSS scr - CVE-2026-71190
OpenStack Swift 资源管理错误漏洞
V. Comments for CVE-2024-1892
No comments yet