CVE-2026-61541

Received Received - Intake

Denial of Service in Zapros Python HTTP Client

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained `Content-Encoding` values causes Zapros to construct a deeply nested decompression chain that consumes excessive resources. Version 0.14.0 patches the vulnerability by limiting responses to five content-encoding layers and raising `DecodingError` when that limit is exceeded. As a workaround, applications can add response middleware that inspects the `Content-Encoding` header and rejects responses containing more than a safe number of encoding layers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-61541

Affected Vendors & Products

Vendor	Product	Version / Range
zapros	zapros	to 0.14.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

Zapros, a Python HTTP client before version 0.14.0, is vulnerable to denial of service via malicious servers. It fails to limit the number of chained Content-Encoding values in responses, allowing attackers to create deeply nested decompression chains that consume excessive system resources.

Detection Guidance

To detect this vulnerability, monitor for excessive chained Content-Encoding headers in HTTP responses. Check for responses with more than five encoding layers, as this indicates potential exploitation. Use tools like curl to inspect headers: curl -I <target-url> | grep 'Content-Encoding'.

Impact Analysis

This vulnerability can cause applications using vulnerable Zapros versions to slow down or crash due to excessive resource consumption. It may lead to degraded performance or complete denial of service when interacting with untrusted servers or following redirects.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA as it primarily causes denial of service through resource exhaustion rather than data breaches or unauthorized access. However, if an application fails to handle this vulnerability, it could lead to service disruptions that may indirectly affect compliance with availability requirements in regulations like GDPR (Article 32) or HIPAA (Security Rule).

Mitigation Strategies

Upgrade Zapros to version 0.14.0 or later to patch the vulnerability. As a temporary workaround, implement middleware to reject responses with more than five Content-Encoding layers. Validate and sanitize all HTTP responses before processing.

Hi! I’m here to help you understand CVE-2026-61541. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70