CVE-2026-61652

What it is

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed responses relying on the chunk size — explicit (`iter_bytes(chunk_size=...)`) or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compressed response could overflow memory. Version 0.14.0 contains a patch. Some workarounds are available. Read the still-compressed body with `Response.iter_raw()` / `Response.async_iter_raw()`, which bypass the built-in decoders, and decompress it yourself with an explicit output-size bound (e.g. `zlib`'s `max_length`), aborting once a configured limit is exceeded. Where feasible, send `Accept-Encoding: identity` to disable response compression so bodies are not decompressed client-side. Avoid decoding response bodies from untrusted servers.

At a glance

Exploitability

Can be exploited over the network without logging in. High risk of service disruption.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-09-21 22:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-24 21:25 UTC Last updatedMost recent change to the record

Details

Published

2026-09-21 22:16 UTC

Last modified

2026-09-24 21:25 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-770 · Allocation without limits

Record status

Deferred

Attack profile CVSS 4.0 · 8.7

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High