---
id: CVE-2026-61652
title: >-
  Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial
  of service via memory exhaustion
summary: >-
  Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial
  of service via memory exhaustion. The issue affects all callers who streamed
  compressed responses relying on the chunk size — explicit
  (`iter_bytes(chunk_size=…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-770
vendor: kap-sh
product: zapros
affected:
  - zapros < 0.14.0
patched:
  - zapros 0.14.0
published: '2026-09-21'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:25:27.050'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61652'
references:
  - url: 'https://github.com/kap-sh/zapros/security/advisories/GHSA-6cp7-3m3c-5x5c'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61652'
  - url: >-
      https://github.com/kap-sh/zapros/commit/9b59fa65857734599c34b0b3dff4c2b62293a68d
  - url: 'https://github.com/kap-sh/zapros/releases/tag/v0.14.0'
  - url: 'https://github.com/advisories/GHSA-6cp7-3m3c-5x5c'
  - url: 'https://github.com/kap-sh/zapros'
tags:
  - nvd
  - cve.org
  - ghsa
  - pip
  - osv
epss: 0.00436
epssPercentile: 0.35157
aliases:
  - GHSA-6cp7-3m3c-5x5c
ecosystem: pip
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-22T14:39:06.743797Z'
cvssSource: cna
ingestedAt: '2026-09-21T21:53:57.433Z'
---

## Overview

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed responses relying on the chunk size — explicit (`iter_bytes(chunk_size=...)`) or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compressed response could overflow memory. Version 0.14.0 contains a patch. Some workarounds are available. Read the still-compressed body with `Response.iter_raw()` / `Response.async_iter_raw()`, which bypass the built-in decoders, and decompress it yourself with an explicit output-size bound (e.g. `zlib`'s `max_length`), aborting once a configured limit is exceeded. Where feasible, send `Accept-Encoding: identity` to disable response compression so bodies are not decompressed client-side. Avoid decoding response bodies from untrusted servers.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-61652)

Affected packages:

- `zapros < 0.14.0`

Patched in:

- `zapros 0.14.0`

Source: https://github.com/advisories/GHSA-6cp7-3m3c-5x5c