Answer in brief
CVE-2026-61541 records a Medium severity (CVSS 6.9) vulnerability in Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service. The current sources do not mark it as known exploited. The current feed maps kap-sh/zapros (generic), zapros (pip), zapros (pypi). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps kap-sh/zapros (generic), zapros (pip), zapros (pypi). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| kap-sh/zaprosgeneric | <0.14.0 | 0.14.0 |
| zaprospip | <0.14.0 | 0.14.0 |
| zaprospypi | >=0 <0.14.0 | 0.14.0 |
Published upstream
Sep 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 21, 2026
Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained `Content-Encoding` values causes Zapros to construct a deeply nested decompression chain that consumes excessive resources. Version 0.14.0 patches the vulnerability by limiting responses to five content-encoding layers and raising `DecodingError` when that limit is exceeded. As a workaround, applications can add response middleware that inspects the `Content-Encoding` header and rejects responses containing more than a safe number of encoding layers.
Quoted source text, attributed separately from HOL analysis.