Denial of Service Vulnerability in Zapros Python HTTP Client

CVE-2026-61541

What is CVE-2026-61541?

The Zapros Python HTTP client, prior to version 0.14.0, is vulnerable to a denial of service attack. This vulnerability is triggered when an application requests content from an untrusted server or follows a redirect to one that sends a malicious response. Specifically, the attacker can manipulate the response to include an excessive number of chained 'Content-Encoding' values. This leads to the creation of a deeply nested decompression chain, which consumes significant system resources, potentially overwhelming the application. Version 0.14.0 addresses this issue by imposing a limit on the number of content-encoding layers to five and introducing a 'DecodingError' to handle violations of this policy. To mitigate the risk before upgrading, it is recommended that applications implement middleware that inspects the 'Content-Encoding' header to block responses that exceed a safe number of encoding layers.

References