Zapros EUVD-2026-84182

Exploitation requires that the application using Zapros (prior to 0.14.0) requests content from a server the attacker controls, or is made to follow a redirect to such a server - the attacker acts as the responding server, not as a client against the victim. The malicious response must contain an excessive number of chained Content-Encoding values so Zapros constructs a deeply nested decompression chain. Limiting factors: it only affects deployments that fetch untrusted/external URLs (or honor redirects to them) using unpatched Zapros; applications restricted to trusted internal endpoints are not exposed. The documented workaround (response middleware rejecting responses with too many Content-Encoding layers) also mitigates without upgrading.

This is a moderate-severity availability issue, not a high-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated trigger, but the only impact is VA:L - a partial availability/resource-consumption effect on the vulnerable system, with no confidentiality (VC:N) or integrity (VI:N) impact and no scope change to other systems. The 6.9 score is therefore driven entirely by ease of reach, not by impact magnitude. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' A key nuance the raw CVSS masks: this is a client-side HTTP library flaw, so 'unauthenticated network' really means the attacker must be (or must control, via a redirect) the server the victim application chooses to fetch from - the victim initiates the connection. That materially narrows real-world exploitability compared to a server-side unauth DoS. CWE-770 (uncontrolled resource consumption) is consistent with the described nested-decompression exhaustion. Bottom line: genuine but bounded DoS risk, best treated as routine patch-cadence remediation rather than an urgent out-of-band fix, weighted further down by the product's obscurity.

An attacker stands up a malicious HTTP server (or an open redirect / attacker-controlled endpoint that a victim application is induced to follow) and returns a response whose Content-Encoding header chains an excessive number of encoding layers. When a pre-0.14.0 Zapros client fetches or is redirected to this response, it builds a deeply nested decompression chain that consumes excessive CPU/memory, degrading or denying service. No public exploit code was identified, but the technique is straightforward given the described root cause.