Denial of Service Vulnerability in Zapros Python HTTP Client by Kap-Sh

CVE-2026-61652

What is CVE-2026-61652?

The Zapros Python HTTP client prior to version 0.14.0 is susceptible to a denial of service attack through memory exhaustion. This vulnerability arises when users stream compressed responses that depend on chunk size, either explicitly or by default. The decoding process fails to respect the specified memory bounds, allowing for improperly sized chunks that may result in overflowing memory. Users can mitigate this issue by using the alternative methods provided in the official documentation, such as utilizing the Response.iter_raw() function to manage the decompression process manually. Additionally, adjusting the Accept-Encoding header to 'identity' can prevent client-side decompression, thus avoiding risks when interacting with untrusted servers.

References