Skip to content
OpenAdvisories

Package · PyPI

zapros

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.9
    CVE-2026-61541

    Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

    Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained `Conte…

    kap-sh zapros zapros PyPI
  • High 8.7
    CVE-2026-61652

    Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

    Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed responses relying on the chunk size — explicit (`iter_bytes(chunk_size=...)`) or the default …

    kap-sh zapros zapros PyPI