CVE-2026-61541: Zapros Python HTTP Client DOS Vulnerability

CVE-2026-61541 Overview

CVE-2026-61541 affects Zapros, a Python HTTP client library, in versions prior to 0.14.0. The vulnerability allows a remote server to trigger a denial of service condition when a client application requests content or follows a redirect to a malicious endpoint. A crafted response containing an excessive number of chained Content-Encoding values causes Zapros to build a deeply nested decompression chain that consumes excessive CPU and memory resources. The flaw is categorized under CWE-770 (Allocation of Resources Without Limits or Throttling).

Critical Impact
A malicious or compromised upstream server can exhaust client resources by returning HTTP responses with an unbounded number of Content-Encoding layers, degrading availability of the requesting application.

Affected Products

Zapros Python HTTP client library, all versions prior to 0.14.0
Applications embedding Zapros that fetch content from untrusted servers
Applications embedding Zapros that follow HTTP redirects to untrusted endpoints

Discovery Timeline

2026-09-21 - CVE-2026-61541 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-61541

Vulnerability Analysis

Zapros processes the HTTP Content-Encoding response header to determine how to decompress response bodies. The library constructs a decompression pipeline that mirrors the encodings declared by the server. Before version 0.14.0, Zapros did not cap the number of chained encoding layers it would accept. An attacker controlling a server response can advertise a large number of encoding steps such as gzip, gzip, gzip, deflate, br, .... Each layer instantiates an additional decompressor stage, consuming memory and CPU cycles.

The issue is a resource-exhaustion denial of service. It does not compromise confidentiality or integrity, but it can render the calling application unresponsive. Any Python service that uses Zapros to fetch third-party URLs, follow redirects, or scrape untrusted content is exposed.

Root Cause

The root cause is missing enforcement of an upper bound on chained Content-Encoding values before allocating decompression resources. The library trusted the server-supplied header and constructed a nested decoder chain proportional to its length, satisfying the conditions described in CWE-770.

Attack Vector

Exploitation requires only that a Zapros-based client issue an HTTP request to attacker-controlled infrastructure, either directly or through a redirect from a legitimate host. The attacker returns a response with an inflated Content-Encoding header. No authentication or user interaction is needed. The attack is network-based and can be launched by any host the client contacts.

See the GitHub Security Advisory GHSA-5vjj-2r48-q622 for the maintainer's technical description.

Detection Methods for CVE-2026-61541

Indicators of Compromise

HTTP responses received by Zapros clients containing more than five values in the Content-Encoding header
Python processes using Zapros exhibiting sudden CPU spikes or memory growth after outbound HTTP requests
Repeated DecodingError exceptions after upgrading to Zapros 0.14.0 or later

Detection Strategies

Inventory Python applications and dependencies for Zapros versions below 0.14.0 using tools such as pip list or software composition analysis
Inspect outbound HTTP traffic at proxies or egress gateways for responses with abnormally long Content-Encoding headers
Correlate application crash or hang events with recent outbound requests to untrusted domains

Monitoring Recommendations

Log the Content-Encoding header of responses handled by Zapros and alert when the layer count exceeds a safe threshold
Monitor per-process resource consumption for services that make outbound HTTP calls with Zapros
Track redirect chains that terminate at low-reputation hosts and flag anomalous response sizes or headers

How to Mitigate CVE-2026-61541

Immediate Actions Required

Upgrade Zapros to version 0.14.0 or later in all affected applications
Audit dependency manifests such as requirements.txt, pyproject.toml, and lockfiles for pinned older versions of Zapros
Restrict outbound HTTP requests from Zapros-based services to trusted destinations where feasible
Restart running services after upgrading to ensure the patched library is loaded

Patch Information

Version 0.14.0 remediates the vulnerability by limiting responses to five Content-Encoding layers and raising DecodingError when that limit is exceeded. Refer to the GitHub Security Advisory GHSA-5vjj-2r48-q622 for the authoritative patch reference.

Workarounds

Add response middleware that inspects the Content-Encoding header and rejects responses containing more than a safe number of encoding layers
Disable following of redirects to untrusted origins when using Zapros to fetch external content
Route outbound HTTP traffic through a filtering proxy that normalizes or strips excessive Content-Encoding values

bash

# Upgrade Zapros to the patched release
pip install --upgrade 'zapros>=0.14.0'

# Verify the installed version
python -c "import zapros; print(zapros.__version__)"