CVE-2026-61541
Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or foll…
Impact
Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained `Content-Encoding` values causes Zapros to construct a deeply nested decompression chain that consumes excessive resources. Version 0.14.0 patches the vulnerability by limiting responses to five content-encoding layers and raising `DecodingError` when that limit is exceeded. As a workaround, applications can add response middleware that inspects the `Content-Encoding` header and rejects responses containing more than a safe number of encoding layers.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | zapros | < 0.14.0 | 0.14.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-5vjj-2r48-q622
- https://github.com/kap-sh/zapros/security/advisories/GHSA-5vjj-2r48-q622
- https://nvd.nist.gov/vuln/detail/CVE-2026-61541
- https://github.com/kap-sh/zapros/commit/7971fbca9707eb01455ca2d73416ac091f96908b
- https://github.com/kap-sh/zapros/releases/tag/v0.14.0