Executive brief
Zapros is an HTTP client library used to make requests to web servers. An attacker can craft a malicious HTTP response with deeply chained compression encodings that forces the client to consume excessive CPU and memory during decompression, leading to denial of service or application hang. This affects any application using Zapros to connect to untrusted servers or that follows redirects to attacker-controlled hosts.
Technical details
The vulnerability is a denial-of-service flaw in Zapros's Content-Encoding header processing. The client fails to limit the number of nested decompression layers when processing a response, allowing an attacker to supply a response with an unbounded chain of content encodings (e.g., "gzip, gzip, gzip, ..."). When the client attempts to decompress, the nested decompression chain consumes excessive memory and CPU, causing resource exhaustion. The fix, available in version 0.14.0, enforces a hardcoded limit of 5 Content-Encoding layers; responses exceeding this raise a DecodingError. The attack requires network reachability to an HTTP server and is feasible when following redirects to attacker-controlled hosts.
Affected products
- Zapros Zapros before 0.14.0
Timeline
- 2026-09-23: disclosed
- 2026-09-23: patched: Fixed in version 0.14.0