CVE-2026-61652

Received Received - Intake

Zapros HTTP Client Memory Exhaustion via Compressed Response

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed responses relying on the chunk size — explicit (`iter_bytes(chunk_size=...)`) or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compressed response could overflow memory. Version 0.14.0 contains a patch. Some workarounds are available. Read the still-compressed body with `Response.iter_raw()` / `Response.async_iter_raw()`, which bypass the built-in decoders, and decompress it yourself with an explicit output-size bound (e.g. `zlib`'s `max_length`), aborting once a configured limit is exceeded. Where feasible, send `Accept-Encoding: identity` to disable response compression so bodies are not decompressed client-side. Avoid decoding response bodies from untrusted servers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-61652

Affected Vendors & Products

Vendor	Product	Version / Range
zapros	zapros	to 0.14.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

Zapros, a Python HTTP client before version 0.14.0, is vulnerable to denial of service via memory exhaustion. The issue occurs when streaming compressed responses with a specified chunk size. The decoder ignores this bound, allowing a single compressed response to consume excessive memory by processing chunks larger than requested.

Detection Guidance

Detecting this vulnerability requires checking if your system uses Zapros versions prior to 0.14.0 and if compressed responses are being processed. Inspect installed packages with pip show zapros or pip list. Monitor memory usage during HTTP requests handling compressed responses. No direct commands are provided for detection.

Impact Analysis

This vulnerability can cause your application to run out of memory, leading to crashes or degraded performance. It specifically affects users who stream compressed responses using Zapros, especially when handling large or maliciously crafted responses from untrusted servers.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that exhaust server or client memory resources. Uncontrolled memory usage may lead to system instability or crashes, which could disrupt data processing or storage operations required for compliance.

Mitigation Strategies

Upgrade Zapros to version 0.14.0 or later. If upgrading is not possible, avoid streaming compressed responses by using Response.iter_raw() or Response.async_iter_raw(). Send Accept-Encoding: identity to disable compression. Implement size limits when decompressing manually.

Hi! I’m here to help you understand CVE-2026-61652. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70