CVE-2026-61652 Overview
CVE-2026-61652 is a denial of service vulnerability in Zapros, a Python HTTP client library, affecting all versions prior to 0.14.0. The flaw resides in the response decompression logic, where the streaming decoder ignores the caller-supplied chunk size bound. A malicious or compromised server can return a compressed response that expands into a single chunk far larger than requested, exhausting client memory. The issue is tracked under CWE-770: Allocation of Resources Without Limits or Throttling. Version 0.14.0 contains the patch.
Critical Impact
A single crafted compressed HTTP response can exhaust process memory on any client that streams responses through Zapros while relying on chunk_size to bound allocations.
Affected Products
- Zapros Python HTTP client, all versions prior to 0.14.0
- Applications using Response.iter_bytes(chunk_size=...) with default or explicit chunk sizes
- Applications using Zapros default response decoders against untrusted or compromised servers
Discovery Timeline
- 2026-09-21 - CVE-2026-61652 published to the National Vulnerability Database
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-61652
Vulnerability Analysis
Zapros exposes streaming response APIs such as Response.iter_bytes(chunk_size=...) that developers use to process large HTTP payloads without loading the full body into memory. Callers pass a chunk size to bound per-iteration memory usage. The vulnerability breaks that contract for compressed responses.
When the server returns a body with Content-Encoding: gzip, deflate, or another supported compression scheme, Zapros routes the raw bytes through a built-in decoder before yielding chunks. The decoder does not honor the requested output bound. A small compressed payload can expand into a single chunk that consumes hundreds of megabytes or more, driving the Python process to allocate until the operating system kills it or the host swaps.
The issue is a resource-exhaustion denial of service and is categorized under [CWE-770]. Impact is limited to availability; there is no confidentiality or integrity impact.
Root Cause
The decompression path in Zapros prior to 0.14.0 lacks an output-size ceiling. Standard-library primitives such as zlib.decompressobj().decompress(data, max_length) accept an explicit output cap, but the vulnerable decoder invokes decompression without passing such a bound. The chunk_size parameter supplied by the caller only constrains reads from the underlying transport, not the size of decompressed output emitted per iteration.
Attack Vector
Exploitation requires that a Zapros client receive a response from an attacker-controlled or attacker-influenced server. The adversary crafts a highly compressible body — for example, a long run of null bytes — and serves it with a compression Content-Encoding header. When the client iterates the response, the decoder inflates the payload into memory in a single operation. Because the attack vector is network-based and requires no authentication or user interaction, any Python service that fetches URLs from untrusted origins is exposed. This includes webhook processors, link previewers, feed aggregators, scrapers, and Server-Side Request Forgery (SSRF) sinks.
No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-6cp7-3m3c-5x5c for maintainer-supplied technical detail.
Detection Methods for CVE-2026-61652
Indicators of Compromise
- Python processes using Zapros terminating with MemoryError or being killed by the Linux OOM killer shortly after outbound HTTP requests
- Sudden resident set size (RSS) growth in worker processes correlated with responses carrying Content-Encoding: gzip, deflate, br, or zstd
- Repeated 5xx errors or worker restarts in services that fetch content from external URLs
Detection Strategies
- Inventory Python dependencies across services and flag any zapros version below 0.14.0 in requirements.txt, poetry.lock, or pip freeze output
- Instrument HTTP client code paths with per-request memory accounting and alert when a single response drives allocation beyond a documented threshold
- Review egress proxy logs for responses with unusually high compression ratios (small Content-Length combined with large decoded size)
Monitoring Recommendations
- Track process memory metrics and OOM-kill events on hosts running Zapros-based workloads
- Alert on repeated crash-restart loops for services that consume third-party HTTP APIs or arbitrary URLs
- Monitor outbound requests to newly observed or low-reputation domains that return compressed content
How to Mitigate CVE-2026-61652
Immediate Actions Required
- Upgrade Zapros to version 0.14.0 or later across all Python environments
- Identify services that call Response.iter_bytes() or rely on default response decoders and prioritize those for patching
- Restrict outbound HTTP requests from Zapros-based services to allowlisted destinations where feasible
Patch Information
Zapros 0.14.0 contains the fix. The patched decoder honors the caller's chunk size when producing decompressed output, preventing unbounded per-chunk allocations. Refer to the GitHub Security Advisory GHSA-6cp7-3m3c-5x5c for the upstream fix commit and release notes.
Workarounds
- Read the compressed body with Response.iter_raw() or Response.async_iter_raw() to bypass the built-in decoders, then decompress manually using zlib.decompressobj().decompress(data, max_length=...) and abort when a configured ceiling is exceeded
- Send Accept-Encoding: identity on outbound requests to disable server-side compression so responses arrive uncompressed
- Avoid decoding response bodies from untrusted servers and enforce hard timeouts plus response-size limits at the HTTP client layer
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
