PT-2026-105923 · Pypi · Zapros

Published

2026-10-01

·

Updated

2026-10-01

CVSS v4.0

6.9

Medium

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Impact

Who is impacted:
  • Any application using Zapros to make HTTP requests to untrusted servers
  • Applications that follow redirects to attacker-controlled hosts
Attack vector:
  • A malicious HTTP server returns a response with many chained content encodings. When the client attempts to decode, it creates a deeply nested decompression chain consuming excessive resources.

Patches

Fixed in version 0.14.0.
The fix adds a hardcoded limit of 5 Content-Encoding layers. Responses exceeding this limit raise DecodingError.

Workarounds

Add middleware that checks for a malicious Content-Encoding header.
python
from typing import cast

from zapros import (
  AsyncBaseHandler,
  AsyncBaseMiddleware,
  BaseHandler,
  BaseMiddleware,
  Client,
  DecodingError,
  Request,
  Response,
)

MAX DECODE LAYERS = 5


class ContentEncodingCheckMiddleware(BaseMiddleware, AsyncBaseMiddleware):
  def  init (
    self,
    next handler: BaseHandler | AsyncBaseHandler,
    *,
    max layers: int = MAX DECODE LAYERS,
  ) -> None:
    self.next = cast(BaseHandler, next handler)
    self.async next = cast(AsyncBaseHandler, next handler)
    self. max layers = max layers

  def check(self, response: Response) -> None:
    encoding header = response.headers.get("Content-Encoding")
    if not encoding header:
      return

    layers = [enc.strip().lower() for enc in encoding header.split(",") if enc.strip()]
    if len(layers) > self. max layers:
      raise DecodingError(f"Too many Content-Encoding layers ({len(layers)}), maximum is {self. max layers}")

  def handle(self, request: Request) -> Response:
    response = self.next.handle(request)
    self. check(response)
    return response

  async def ahandle(self, request: Request) -> Response:
    response = await self.async next.ahandle(request)
    self. check(response)
    return response


with Client().wrap with middleware(lambda next: ContentEncodingCheckMiddleware(next)) as client:
  ...

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾

Related Identifiers

PYSEC-2026-4181

Affected Products

Zapros