CVE-2026-61541

35th percentile - higher than 35% of all known CVEs

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained `Content-Encoding` values causes Zapros to construct a deeply nested decompression chain that consumes excessive resources. Version 0.14.0 patches the vulnerability by limiting responses to five content-encoding layers and raising `DecodingError` when that limit is exceeded. As a workaround, applications can add response middleware that inspects the `Content-Encoding` header and rejects responses containing more than a safe number of encoding layers.

An attacker can cause system resource exhaustion, leading to unavailability of applications using Zapros. The organization is at risk of service disruptions.

Update Zapros to version 0.14.0 or later. If not possible, apply response middleware to limit the number of Content-Encoding layers.