Executive brief
Zapros is a Python HTTP client library. A flaw in its streaming decompression allows a malicious server to send a highly compressed file that expands to consume all available memory when decompressed, causing the client application to crash or freeze. An attacker controlling the server can exploit this to deny service to applications that stream responses from untrusted sources.
Technical details
Zapros's streaming decoder (used by iter_bytes() and async_iter_bytes()) ignored the requested chunk_size parameter when decompressing compressed HTTP responses (gzip, deflate, brotli, zstd). This allowed a single compressed chunk to decompress to an arbitrary size, bypassing the caller's memory bounds. An attacker can craft a small compressed payload (e.g., ~1 MiB gzip-compressed zeros) that expands to gigabytes on decompression, exhausting memory. The vulnerability affects all callers relying on chunk_size to bound peak memory consumption. Fixed in version 0.14.0 by applying output-size limits at the decoder level (zlib max_length, brotli output_buffer_limit, zstd bounded stream_writer).
Affected products
- Zapros before 0.14.0
Timeline
- 2026-09-23: disclosed: Advisory published
- 2026: patched: Fixed in version 0.14.0