{"id":"GHSA-6cp7-3m3c-5x5c","summary":"Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)","details":"### Impact\n\nDenial of service via memory exhaustion. Affects all callers who streamed compressed responses relying on the chunk size — explicit (`iter_bytes(chunk_size=...)`) or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compressed response could overflow memory.\n\n```python\nimport gzip, zapros\n\n# Server returns ~1 GiB of zeros gzip-compressed to ~1 MiB,\n# with header: Content-Encoding: gzip\nbomb = gzip.compress(b\"\\0\" * 1_000_000_000)  # ~1 MiB on the wire\n\nwith zapros.stream(\"GET\", \"https://malicious.example/bomb\") as response:\n    # Caller asks for 8 KiB chunks, expecting bounded memory:\n    for chunk in response.iter_bytes(chunk_size=8192):\n        ...  # first `chunk` is ~1 GiB, not 8 KiB -\u003e memory exhaustion\n```\n\n### Patches\n\nUpgrade to `0.14.0` or later. The decoders now bound the output of each decompression step to the requested `chunk_size`: gzip/deflate via `zlib`'s `max_length` + `unconsumed_tail`, brotli via `output_buffer_limit`, and zstd via a bounded `stream_writer`. Peak memory during streaming decode is now proportional to `chunk_size` for all supported encodings.\n\n### Workarounds\n\nFor unpatched versions:\n- Read the still-compressed body with `Response.iter_raw()` / `Response.async_iter_raw()`, which bypass the built-in decoders, and decompress it yourself with an explicit output-size bound (e.g. `zlib`'s `max_length`), aborting once a configured limit is exceeded.\n- Where feasible, send `Accept-Encoding: identity` to disable response compression so bodies are not decompressed client-side.\n- Avoid decoding response bodies from untrusted servers.","aliases":["CVE-2026-61652"],"modified":"2026-09-23T14:15:04.374049293Z","published":"2026-09-23T13:57:48Z","database_specific":{"nvd_published_at":"2026-09-21T22:16:57Z","cwe_ids":["CWE-770"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-09-23T13:57:48Z"},"references":[{"type":"WEB","url":"https://github.com/kap-sh/zapros/security/advisories/GHSA-6cp7-3m3c-5x5c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61652"},{"type":"WEB","url":"https://github.com/kap-sh/zapros/commit/9b59fa65857734599c34b0b3dff4c2b62293a68d"},{"type":"PACKAGE","url":"https://github.com/kap-sh/zapros"},{"type":"WEB","url":"https://github.com/kap-sh/zapros/releases/tag/v0.14.0"}],"affected":[{"package":{"name":"zapros","ecosystem":"PyPI","purl":"pkg:pypi/zapros"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0"}]}],"versions":["0.10.0","0.11.0","0.11.1","0.12.0","0.13.0","0.2.0","0.2.1","0.2.2","0.2.3","0.3.0","0.4.0","0.5.0","0.5.1","0.6.0","0.7.0","0.8.0","0.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6cp7-3m3c-5x5c/GHSA-6cp7-3m3c-5x5c.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}