EUVD-2026-84175

Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory decompression bomb...

CVE-2026-61652

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed responses relying on the chunk size — explicit iterbyteschunksize=... or the default — to bound memory. The decoder ignored that...