PT-2026-105923 · Pypi · Zapros
Published
2026-10-01
·
Updated
2026-10-01
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
Impact
Who is impacted:
- Any application using Zapros to make HTTP requests to untrusted servers
- Applications that follow redirects to attacker-controlled hosts
Attack vector:
- A malicious HTTP server returns a response with many chained content encodings. When the client attempts to decode, it creates a deeply nested decompression chain consuming excessive resources.
Patches
Fixed in version 0.14.0.
The fix adds a hardcoded limit of 5
Content-Encoding layers. Responses exceeding this limit raise DecodingError.Workarounds
Add middleware that checks for a malicious Content-Encoding header.
python
from typing import cast
from zapros import (
AsyncBaseHandler,
AsyncBaseMiddleware,
BaseHandler,
BaseMiddleware,
Client,
DecodingError,
Request,
Response,
)
MAX DECODE LAYERS = 5
class ContentEncodingCheckMiddleware(BaseMiddleware, AsyncBaseMiddleware):
def init (
self,
next handler: BaseHandler | AsyncBaseHandler,
*,
max layers: int = MAX DECODE LAYERS,
) -> None:
self.next = cast(BaseHandler, next handler)
self.async next = cast(AsyncBaseHandler, next handler)
self. max layers = max layers
def check(self, response: Response) -> None:
encoding header = response.headers.get("Content-Encoding")
if not encoding header:
return
layers = [enc.strip().lower() for enc in encoding header.split(",") if enc.strip()]
if len(layers) > self. max layers:
raise DecodingError(f"Too many Content-Encoding layers ({len(layers)}), maximum is {self. max layers}")
def handle(self, request: Request) -> Response:
response = self.next.handle(request)
self. check(response)
return response
async def ahandle(self, request: Request) -> Response:
response = await self.async next.ahandle(request)
self. check(response)
return response
with Client().wrap with middleware(lambda next: ContentEncodingCheckMiddleware(next)) as client:
...Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Zapros