CVE-2026-61652High· 8.7▾ TwilightZapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed responses relying on the chunk size — explicit (`iter_bytes(chunk_size=…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.4%
Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed responses relying on the chunk size — explicit (iter_bytes(chunk_size=...)) or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compressed response could overflow memory. Version 0.14.0 contains a patch. Some workarounds are available. Read the still-compressed body with Response.iter_raw() / Response.async_iter_raw(), which bypass the built-in decoders, and decompress it yourself with an explicit output-size bound (e.g. zlib's max_length), aborting once a configured limit is exceeded. Where feasible, send Accept-Encoding: identity to disable response compression so bodies are not decompressed client-side. Avoid decoding response bodies from untrusted servers.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
zapros < 0.14.0Patched in:
zapros 0.14.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61541Medium· 6.9Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive nu…
CVE-2026-102682Medium· 5.6Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents
CVE-2026-101917Medium· 5.3PyJWT is a Python implementation of JSON Web Token standards
CVE-2026-100650Medium· 6.5vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-p…
CVE-2025-69223High· 7.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
CVE-2026-100350Medium· 5.3kin-openapi is a Go project for handling OpenAPI files