CVE-2026-61541 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

What is CVE-2026-61541?

CVE-2026-61541 is a medium-severity denial of service vulnerability in kap-sh zapros, published on 21 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained `Content-Encoding` values causes Zapros to construct a deeply nested decompression chain that consumes excessive resources. Version 0.14.0 patches the vulnerability by limiting responses to five content-encoding layers and raising `DecodingError` when that limit is exceeded. As a workaround, applications can add response middleware that inspects the `Content-Encoding` header and rejects responses containing more than a safe number of encoding layers.

Weakness: CWE-770

Which versions are affected by CVE-2026-61541?

3 open source packages ship an affected version, including zapros.

How do I fix CVE-2026-61541?

Upgrade zapros to 0.14.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-61541 being exploited?

There is no known exploitation of CVE-2026-61541 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5vjj-2r48-q622, PYSEC-2026-4181.