CVE-2026-61652 Details
Description
Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed responses relying on the chunk size — explicit (`iter_bytes(chunk_size=...)`) or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compressed response could overflow memory. Version 0.14.0 contains a patch. Some workarounds are available. Read the still-compressed body with `Response.iter_raw()` / `Response.async_iter_raw()`, which bypass the built-in decoders, and decompress it yourself with an explicit output-size bound (e.g. `zlib`'s `max_length`), aborting once a configured limit is exceeded. Where feasible, send `Accept-Encoding: identity` to disable response compression so bodies are not decompressed client-side. Avoid decoding response bodies from untrusted servers.
A denial-of-service vulnerability has been identified in Zapros, a Python HTTP client, in versions prior to 0.14.0. The issue arises in all cases where compressed responses are streamed and the chunk size is used to limit memory usage. The vulnerability allows a single compressed chunk to be much larger than requested, leading to memory overflow. This problem can be exploited by reading the response with the default chunk size or an explicitly set one.
Users are advised to upgrade to Zapros version 0.14.0 or later, where the issue has been patched. For those using unpatched versions, it is recommended to read the compressed response body with 'Response.iter_raw()' or 'Response.async_iter_raw()', bypassing the built-in decoders, and to manually decompress the data with a specified output-size limit. Additionally, where possible, send 'Accept-Encoding: identity' to disable response compression.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kap-sh/zapros/security/advisories/GHSA-6cp7-3m3c-5x5c | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kap-sh Zapros | < 0.14.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |