CVE-2026-61652 Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

What is CVE-2026-61652?

CVE-2026-61652 is a high-severity denial of service vulnerability in kap-sh zapros, published on 21 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed responses relying on the chunk size — explicit (`iter_bytes(chunk_size=...)`) or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compressed response could overflow memory. Version 0.14.0 contains a patch. Some workarounds are available. Read the still-compressed body with `Response.iter_raw()` / `Response.async_iter_raw()`, which bypass the built-in decoders, and decompress it yourself with an explicit output-size bound (e.g. `zlib`'s `max_length`), aborting once a configured limit is exceeded. Where feasible, send `Accept-Encoding: identity` to disable response compression so bodies are not decompressed client-side. Avoid decoding response bodies from untrusted servers.

Weakness: CWE-770

Which versions are affected by CVE-2026-61652?

3 open source packages ship an affected version, including zapros.

How do I fix CVE-2026-61652?

Upgrade zapros to 0.14.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-61652 being exploited?

There is no known exploitation of CVE-2026-61652 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6cp7-3m3c-5x5c, PYSEC-2026-4182.