Zapros
Monthly
Denial of service via memory exhaustion affects Zapros, the Python HTTP client, in all releases prior to 0.14.0. An unauthenticated remote attacker who controls, or can man-in-the-middle, the origin server can return a small compressed response that the built-in decompression decoder inflates far beyond the caller-supplied bound, because iter_bytes(chunk_size=...) and its default are ignored during decoding - a single chunk can therefore exhaust process or host memory (CVSS 4.0 8.7 High, availability-only: VA:H, VC:N, VI:N, PR:N, UI:N). The vendor released a fix in 0.14.0, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Zapros prior to 0.14.0 allows a malicious or compromised server, or a redirect target, to exhaust resources by returning a response with an excessive number of chained Content-Encoding values, forcing Zapros to construct a deeply nested decompression chain. The vulnerability affects applications that fetch content from untrusted servers or follow redirects to them using unpatched Zapros; no public exploit is identified at time of analysis. The CVSS 4.0 vector indicates network-based, unauthenticated exploitation with only low availability impact (score 6.9), making this a moderate-severity availability issue rather than a high-priority emergency.
Denial of service via memory exhaustion affects Zapros, the Python HTTP client, in all releases prior to 0.14.0. An unauthenticated remote attacker who controls, or can man-in-the-middle, the origin server can return a small compressed response that the built-in decompression decoder inflates far beyond the caller-supplied bound, because iter_bytes(chunk_size=...) and its default are ignored during decoding - a single chunk can therefore exhaust process or host memory (CVSS 4.0 8.7 High, availability-only: VA:H, VC:N, VI:N, PR:N, UI:N). The vendor released a fix in 0.14.0, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Zapros prior to 0.14.0 allows a malicious or compromised server, or a redirect target, to exhaust resources by returning a response with an excessive number of chained Content-Encoding values, forcing Zapros to construct a deeply nested decompression chain. The vulnerability affects applications that fetch content from untrusted servers or follow redirects to them using unpatched Zapros; no public exploit is identified at time of analysis. The CVSS 4.0 vector indicates network-based, unauthenticated exploitation with only low availability impact (score 6.9), making this a moderate-severity availability issue rather than a high-priority emergency.