EXECUTIVE SUMMARY:
The Zapros Python package is affected by two vulnerabilities that can allow remote denial-of-service conditions through malicious compressed HTTP responses. One involves an unbounded chain of Content-Encoding layers that can trigger excessive resource consumption during decompression while the other occurs because streaming decoders fail to enforce the requested chunk-size limit and can allocate excessive memory when processing compressed responses.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
The Zapros Python package is affected by two vulnerabilities that can allow remote denial-of-service conditions through malicious compressed HTTP responses. One involves an unbounded chain of Content-Encoding layers that can trigger excessive resource consumption during decompression while the other occurs because streaming decoders fail to enforce the requested chunk-size limit and can allocate excessive memory when processing compressed responses.[emaillocker id="1283"]
CVE-2026-61652 (CVSS 8.7 — High): Zapros streaming decoders fail to enforce the requested chunk-size limit allowing a compressed response to expand into an excessively large memory allocation and cause memory exhaustion. The vulnerability can be triggered when processing compressed responses from untrusted servers.
CVE-2026-61541 (CVSS 6.9 — Medium): Zapros is vulnerable to denial of service because malicious HTTP responses containing deeply chained Content-Encoding layers can cause excessive resource consumption during decompression. The issue affects applications making requests to untrusted servers or following redirects to attacker-controlled hosts.
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-6cp7-3m3c-5x5c
https://github.com/advisories/GHSA-5vjj-2r48-q622