CVE-2026-61541
— UNSCOREDpublic exploit availablePublished 2026-09-21 · Updated 2026-09-21
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained `Content-Encoding` values causes Zapros to construct a deeply nested decompression chain that consumes excessive resources. Version 0.14.0 patches the vulnerability by limiting responses to five content-encoding layers and raising `DecodingError` when that limit is exceeded. As a workaround, applications can add response middleware that inspects the `Content-Encoding` header and rejects responses containing more than a safe number of encoding layers.
Weaknesses
CWE-770
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-16100
- UNSCOREDCVE-2026-18401PoC
- MEDIUMCVE-2026-55996PoC
- HIGHCVE-2026-59675PoC
- HIGHCVE-2026-61629PoC
- UNSCOREDCVE-2026-61652PoC
- UNSCOREDCVE-2026-65654PoC
- HIGHCVE-2026-66257
Related by shared AI tags and CWE weakness class. Browse the full archive.