Scrapy API Vulnerable to ReDoS Attack

CVE-2024-1892

What is CVE-2024-1892?

A vulnerability exists in the XMLFeedSpider class of the Scrapy project, presenting a Regular Expression Denial of Service (ReDoS) risk. When compromised XML content is parsed, the inefficiency in regular expression handling can lead to a situation where the system becomes unresponsive, consuming extensive computational resources. This results in a denial-of-service condition for systems utilizing Scrapy for XML processing, causing significant interruptions to service availability.

References