CVE-2026-61541Published 2026-09-23Medium severity

Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

A GitHub-reviewed security advisory, not necessarily under active exploitation the way our CISA KEV advisories are, but a real, disclosed vulnerability in an open-source dependency.

Affected packages

zaprospip

Vulnerable: < 0.14.0

Patched in 0.14.0

Details

Impact

Who is impacted:

Any application using Zapros to make HTTP requests to untrusted servers
Applications that follow redirects to attacker-controlled hosts

Attack vector:

A malicious HTTP server returns a response with many chained content encodings. When the client attempts to decode, it creates a deeply nested decompression chain consuming excessive resources.

Patches

Fixed in version 0.14.0.

The fix adds a hardcoded limit of 5 Content-Encoding layers. Responses exceeding this limit raise DecodingError.

Workarounds

Add middleware that checks for a malicious Content-Encoding header.

from typing import cast

from zapros import (
    AsyncBaseHandler,
    AsyncBaseMiddleware,
    BaseHandler,
    BaseMiddleware,
    Client,
    DecodingError,
    Request,
    Response,
)

MAX_DECODE_LAYERS = 5


class ContentEncodingCheckMiddleware(BaseMiddleware, AsyncBaseMiddleware):
    def __init__(
        self,
        next_handler: BaseHandler | AsyncBaseHandler,
        *,
        max_layers: int = MAX_DECODE_LAYERS,
    ) -> None:
        self.next = cast(BaseHandler, next_handler)
        self.async_next = cast(AsyncBaseHandler, next_handler)
        self._max_layers = max_layers

    def _check(self, response: Response) -> None:
        encoding_header = response.headers.get("Content-Encoding")
        if not encoding_header:
            return

        layers = [enc.strip().lower() for enc in encoding_header.split(",") if enc.strip()]
        if len(layers) > self._max_layers:
            raise DecodingError(f"Too many Content-Encoding layers ({len(layers)}), maximum is {self._max_layers}")

    def handle(self, request: Request) -> Response:
        response = self.next.handle(request)
        self._check(response)
        return response

    async def ahandle(self, request: Request) -> Response:
        response = await self.async_next.ahandle(request)
        self._check(response)
        return response


with Client().wrap_with_middleware(lambda next: ContentEncodingCheckMiddleware(next)) as client:
    ...

EPSS, exploit probability

Low

0.43%

estimated chance of real-world exploitation in the next 30 days, higher than 37.3% of every CVE FIRST.org scores

Refreshed 11/8/2026, via FIRST.org's EPSS model, not CVSS, this measures likelihood of exploitation, not how severe it would be.

CWE-770

Talk to us about this

Secure Code Review

Find out whether this dependency (or others like it) is actually reachable in your codebase.

Security Engineering

Get help patching, or building dependency-scanning into your pipeline going forward.

Our guide to container image scanning and software supply chain security

View on GitHub Security Advisories View on NVD

Wondering what else is lurking in your dependencies?

A secure code review or supply chain review finds this before an advisory does.

Request a Security Assessment Browse Services

from typing import cast from zapros import ( AsyncBaseHandler, AsyncBaseMiddleware, BaseHandler, BaseMiddleware, Client, DecodingError, Request, Response, ) MAX_DECODE_LAYERS = 5 class ContentEncodingCheckMiddleware(BaseMiddleware, AsyncBaseMiddleware): def __init__( self, next_handler: BaseHandler | AsyncBaseHandler, *, max_layers: int = MAX_DECODE_LAYERS, ) -> None: self.next = cast(BaseHandler, next_handler) self.async_next = cast(AsyncBaseHandler, next_handler) self._max_layers = max_layers def _check(self, response: Response) -> None: encoding_header = response.headers.get("Content-Encoding") if not encoding_header: return layers = [enc.strip().lower() for enc in encoding_header.split(",") if enc.strip()] if len(layers) > self._max_layers: raise DecodingError(f"Too many Content-Encoding layers ({len(layers)}), maximum is {self._max_layers}") def handle(self, request: Request) -> Response: response = self.next.handle(request) self._check(response) return response async def ahandle(self, request: Request) -> Response: response = await self.async_next.ahandle(request) self._check(response) return response with Client().wrap_with_middleware(lambda next: ContentEncodingCheckMiddleware(next)) as client: ...