CVE-2026-61541: Zapros Unbounded Content-Encoding Decompression Chain Vulnerability

Background

Zapros is a Python library designed for making HTTP requests, particularly useful for applications that need to interact with web services. It provides a simple interface for sending requests and handling responses. However, it is vulnerable to a specific issue where it can be exploited by malicious HTTP servers through unbounded content encoding, leading to denial of service.

Vulnerability Detail

The vulnerability arises from the ability of a malicious HTTP server to return a response with multiple chained content encodings. When the Zapros client attempts to decode these encodings, it creates a deeply nested decompression chain that consumes excessive system resources. This can lead to denial of service, affecting the application's performance and availability. The vulnerability primarily impacts applications that make HTTP requests to untrusted servers or follow redirects to potentially malicious hosts.

pip install --upgrade "zapros==0.22.0"

pip install --upgrade "zapros==0.14.0"

Workaround

As a temporary workaround, you can implement middleware to check for excessive Content-Encoding layers in the response. Below is a sample implementation in Python:

from typing import cast
from zapros import (
    AsyncBaseHandler,
    AsyncBaseMiddleware,
    BaseHandler,
    Client,
    DecodingError,
    Request,
    Response,
)

MAX_DECODE_LAYERS = 5

class ContentEncodingCheckMiddleware(BaseMiddleware, AsyncBaseMiddleware):
    def __init__(self, next_handler: BaseHandler | AsyncBaseHandler, *, max_layers: int = MAX_DECODE_LAYERS) -> None:
        self.next = cast(BaseHandler, next_handler)
        self.async_next = cast(AsyncBaseHandler, next_handler)
        self._max_layers = max_layers

    def _check(self, response: Response) -> None:
        encoding_header = response.headers.get("Content-Encoding")
        if not encoding_header:
            return

        layers = [enc.strip().lower() for enc in encoding_header.split(",") if enc.strip()]
        if len(layers) > self._max_layers:
            raise DecodingError(f"Too many Content-Encoding layers ({len(layers)}), maximum is {self._max_layers}")

    def handle(self, request: Request) -> Response:
        response = self.next.handle(request)
        self._check(response)
        return response

    async def ahandle(self, request: Request) -> Response:
        response = await self.async_next.ahandle(request)
        self._check(response)
        return response

with Client().wrap_with_middleware(lambda next: ContentEncodingCheckMiddleware(next)) as client:
    ...

Conclusion

The Zapros library has a vulnerability (CVE-2026-61541) that allows for denial of service through unbounded content encoding. Users are advised to update to version 0.14.0 or later to mitigate this risk. Implementing middleware can serve as a temporary workaround while updates are applied.

See every vulnerability recorded for zapros →

FAQ