CVE-2026-61652: Zapros Memory Exhaustion Vulnerability Due to Ignored Chunk Size
Summary
CVE-2026-61652: Impact Denial of service via memory exhaustion. Affects zapros versions < 0.14.0. Fixed in 0.14.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zapros is a Python library designed for making HTTP requests with a focus on streaming responses. It allows users to handle large data transfers efficiently by processing data in chunks. However, a critical vulnerability has been identified that affects its ability to manage memory effectively when dealing with compressed responses, potentially leading to denial of service through memory exhaustion.
Vulnerability Detail
The vulnerability arises from the way Zapros handles streaming decoders for compressed responses. Specifically, the library ignores the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory. This can lead to a situation where a compressed response, which is expected to be limited in size, instead consumes excessive memory, resulting in a denial of service. The issue affects all users who rely on streamed compressed responses, whether they specify a chunk size or use the default settings.
How To Fix
Latest published version: 0.22.0 as of 22 Oct 2026
pip install --upgrade "zapros==0.22.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.14.0
This is the first release that contains the fix.
pip install --upgrade "zapros==0.14.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For users unable to upgrade to the patched version, the following workarounds are recommended:
- Read the still-compressed body using 'Response.iter_raw()' or 'Response.async_iter_raw()' to bypass the built-in decoders. You can then decompress it manually with an explicit output-size bound, such as using zlib's max_length.
- If feasible, send 'Accept-Encoding: identity' in the request headers to disable response compression, ensuring that bodies are not decompressed client-side. Example code for manual decompression:
import zlib
response = zapros.stream("GET", "https://malicious.example/bomb")
compressed_data = response.iter_raw()
# Decompress with a size limit
try:
decompressed_data = zlib.decompress(compressed_data, max_length=8192)
except zlib.error:
print('Decompression exceeded size limit.')
Conclusion
The Zapros library has a critical vulnerability (CVE-2026-61652) that can lead to memory exhaustion due to improper handling of compressed response chunk sizes. Users are strongly advised to upgrade to version 0.14.0 or later to mitigate this risk. Workarounds are available for those unable to upgrade immediately.
See every vulnerability recorded for zapros →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary consequence is denial of service due to memory exhaustion, which can lead to application crashes or unresponsiveness.
Yes, you can implement workarounds such as reading the compressed body with 'Response.iter_raw()' and decompressing it manually with size limits.
All versions of Zapros prior to 0.14.0 are affected by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for zapros.
