CVE-2026-61541 Details

A denial-of-service vulnerability has been identified in the Zapros Python HTTP client, affecting versions prior to 0.14.0. The issue arises when an application requests content from an untrusted server or follows a redirect to one. A malicious response with an excessive number of chained 'Content-Encoding' values can create a deeply nested decompression process, consuming excessive resources. This vulnerability is patched in version 0.14.0, which limits 'Content-Encoding' layers to five and raises a 'DecodingError' when the limit is exceeded. As a workaround, applications can implement response middleware to inspect the 'Content-Encoding' header and reject responses with too many encoding layers.

Users can upgrade to Zapros version 0.14.0 or later, which includes the patch for this vulnerability. Alternatively, response middleware can be added to check the 'Content-Encoding' header and reject responses with more than five encoding layers.