Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to construct a deeply nested decompression chain that consumes excessive resources. Version 0.14.0 patches the vulnerability by limiting responses to five content-encoding layers and raising DecodingError when that limit is exceeded. As a workaround, applications can add response middleware that inspects the Content-Encoding header and rejects responses containing more than a safe number of encoding layers.

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed responses relying on the chunk size — explicit (iterbytes(chunksize=...)) or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compressed response could overflow memory. Version 0.14.0 contains a patch. Some workarounds are available. Read the still-compressed body with Response.iterraw() / Response.asynciterraw(), which bypass the built-in decoders, and decompress it yourself with an explicit output-size bound (e.g. zlib's maxlength), aborting once a configured limit is exceeded. Where feasible, send Accept-Encoding: identity to disable response compression so bodies are not decompressed client-side. Avoid decoding response bodies from untrusted servers.