CVE-2026-61541Medium· 6.9▾ SunlitZapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive nu…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 38 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.4%
Last analysed / modified upstream
Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to construct a deeply nested decompression chain that consumes excessive resources. Version 0.14.0 patches the vulnerability by limiting responses to five content-encoding layers and raising DecodingError when that limit is exceeded. As a workaround, applications can add response middleware that inspects the Content-Encoding header and rejects responses containing more than a safe number of encoding layers.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
zapros < 0.14.0Patched in:
zapros 0.14.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61652High· 8.7Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion
CVE-2026-102682Medium· 5.6Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents
CVE-2026-101917Medium· 5.3PyJWT is a Python implementation of JSON Web Token standards
CVE-2026-100650Medium· 6.5vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-p…
CVE-2025-69223High· 7.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
CVE-2026-100350Medium· 5.3kin-openapi is a Go project for handling OpenAPI files