Zapros EUVD-2026-84175

Exploitation requires the victim application to (1) use Zapros <0.14.0 and (2) stream a compressed response - via iter_bytes(chunk_size=...) or the default - from a server the attacker controls or can MITM, while relying on the chunk-size bound to cap memory. The specific defect is that the built-in decompression decoder ignores the caller's chunk_size limit, so one compressed chunk can inflate arbitrarily. Limiting factors: the attacker must serve the malicious compressed body (client-initiated connection to a hostile/compromised origin), and the impact is confined to availability (process/host memory exhaustion) with no data disclosure or modification. Mitigations that remove the condition: reading with Response.iter_raw()/async_iter_raw() and decompressing manually with an explicit output-size bound (e.g. zlib max_length), or sending Accept-Encoding: identity to disable server-side compression.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H, base 8.7 High) correctly isolates the impact to availability only (VA:H) with no confidentiality or integrity loss, consistent with a CWE-770 memory-exhaustion/decompression-bomb flaw. There is no EPSS score, no CISA KEV listing, and no public exploit code provided, so the signal is: no public exploit identified at time of analysis and no evidence of active exploitation. The scored network vector and no-privilege/no-interaction rating are technically defensible because a caller-side HTTP client is compromised simply by streaming a compressed response, but exploitation is directionally inverted from a typical server flaw - the ATTACKER must control (or MITM) the HTTP server the victim's application chooses to contact, which is a meaningful real-world gate the base score does not surface. Net: this is a legitimate availability bug worth patching for any service that fetches compressed data from untrusted origins, but it is not a drop-everything internet-wide threat - the affected product's tiny footprint and the requirement to talk to a hostile server keep realistic priority moderate rather than critical.

An application uses the Zapros HTTP client (<0.14.0) to stream responses from a remote endpoint and relies on iter_bytes(chunk_size=...) or the default chunk size to cap memory usage. An attacker who controls or intercepts that endpoint returns a small, highly compressed (e.g. gzip/deflate) response that the client-side decoder inflates far beyond the requested chunk bound, exhausting process memory and crashing the client or its host service. No public proof-of-concept is referenced in the available data.