p PatchFirst

CVE-2026-61541

CVE-2026-61541 · Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained `Content-Encoding` values causes Zapros to construct a deeply nested decompression chain that consumes excessive resources. Version 0.14.0 patches the vulnerability by limiting responses to five content-encoding layers and raising `DecodingError` when that limit is exceeded. As a workaround, applications can add response middleware that inspects the `Content-Encoding` header and rejects responses containing more than a safe number of encoding layers.

CVSS 6.9 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • zapros

    Versions
    • < 0.14.0: Affected

    No fix published

  • zapros PyPI

    Versions
    • 0.10.0
    • 0.11.0
    • 0.11.1
    • 0.12.0
    • 0.13.0
    • 0.2.0
    • 0.2.1
    • 0.2.2
    • 0.2.3
    • 0.3.0
    • 0.4.0
    • 0.5.0
    • 0.5.1
    • 0.6.0
    • 0.7.0
    • 0.8.0
    • 0.9.0
    Affected ranges
    • ECOSYSTEM: < 0.14.0

    Update to 0.14.0

Original sources

Check your server →