Vulnerability in zapros (CVE-2026-61541)
Summary
Vulnerability in zapros (CVE-2026-61541). Risk of unauthorized operations or information disclosure. Exploitable via DecodingError. Mitigation: upgrade to 0.14.0 or later.
Original description
The description as published by the source.
Impact
Who is impacted:
- Any application using Zapros to make HTTP requests to untrusted servers
- Applications that follow redirects to attacker-controlled hosts
Attack vector:
- A malicious HTTP server returns a response with many chained content encodings. When the client attempts to decode, it creates a deeply nested decompression chain consuming excessive resources.
Patches
Fixed in version 0.14.0.
The fix adds a hardcoded limit of 5 Content-Encoding layers. Responses exceeding this limit raise DecodingError.
Workarounds
Add middleware that checks for a malicious Content-Encoding header.
from typing import cast
from zapros import (
AsyncBaseHandler,
AsyncBaseMiddleware,
BaseHandler,
BaseMiddleware,
Client,
DecodingError,
Request,
Response,
)
MAX_DECODE_LAYERS = 5
class ContentEncodingCheckMiddleware(BaseMiddleware, AsyncBaseMiddleware):
def __init__(
self,
next_handler: BaseHandler | AsyncBaseHandler,
*,
max_layers: int = MAX_DECODE_LAYERS,
) -> None:
self.next = cast(BaseHandler, next_handler)
self.async_next = cast(AsyncBaseHandler, next_handler)
self._max_layers = max_layers
def _check(self, response: Response) -> None:
encoding_header = response.headers.get("Content-Encoding")
if not encoding_header:
return
layers = [enc.strip().lower() for enc in encoding_header.split(",")…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-61541 has been found in zapros.
Attackers can target a specific entry point like DecodingError over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade zapros to 0.14.0 or later.
If unsure, ask your IT team or search "zapros CVE-2026-61541" on the vendor's site.
CVE-2026-61541 (zapros) — CWE-770
Attack surface: DecodingError
Patched: 0.14.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-770) exists in zapros. Attackers reach the vulnerable code path via DecodingError.
Check the vendor advisory for the affected versions of zapros. Attack surface: DecodingError.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 0.14.0.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'zapros' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'zapros' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
zaprosを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade zapros to 0.14.0ステージング環境で 0.14.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- package pypi.org
- web github.com
- web github.com
- web github.com