Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Who is impacted: - Any application using Zapros to make HTTP requests to untrusted servers - Applications that follow redirects to attacker-controlled hosts Attack vector: - A malicious HTTP server returns a response with many chained content encodings. When the client attempts to decode, it creates a deeply nested decompression chain consuming excessive resources. Patches Fixed in version 0.14.0. The fix adds a hardcoded limit of 5 Content-Encoding layers. Responses exceeding this limit raise DecodingError. Workarounds Add middleware that checks for a malicious Content-Encoding header.
Recommended action: Upgrade to 0.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Denial of service via memory exhaustion. Affects all callers who streamed compressed responses relying on the chunk size — explicit (iterbytes(chunksize=...)) or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compressed response could overflow memory. Patches Upgrade to 0.14.0 or later. The decoders now bound the output of each decompression step to the requested chunksize: gzip/deflate via zlib's maxlength + unconsumedtail, brotli via outputbufferlimit, and zstd via a bounded streamwriter. Peak memory during streaming decode is now proportional to chunksize for all supported encodings. Workarounds For unpatched versions: - Read the still-compressed body with Response.iterraw() / Response.asynciterraw(), which bypass the built-in decoders, and decompress it yourself with an explicit output-size bound (e.g. zlib's maxlength), aborting once a configured limit is exceeded. - Where feasible, send…
Recommended action: Upgrade to 0.14.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.