The Zapros Python HTTP client is vulnerable to a denial of service attack via maliciously crafted Content-Encoding headers, potentially leading to resource exhaustion.

The vulnerability is a resource allocation flaw (CWE-770) where an unauthenticated attacker can force the client to construct a deeply nested decompression chain, consuming excessive system resources. This occurs when the client processes responses from untrusted servers or follows redirects to malicious endpoints.

Successful exploitation allows an attacker to cause a denial of service on applications utilizing the Zapros library, resulting in potential service outages. With a CVSS 4.0 score of 6.9, this vulnerability represents a medium-severity risk that could disrupt business operations if critical services rely on this client for external communications.

Immediate Action: Update the kap-sh zapros package to version 0.14.0 or later to implement the required decompression limits.

Proactive Monitoring: Monitor application logs for unexpected resource spikes or frequent occurrence of decompression-related errors in HTTP processing tasks.

Compensating Controls: Implement middleware that inspects the Content-Encoding header on incoming HTTP responses and rejects any responses containing an excessive number of encoding layers.

Public Exploit Available: Unknown

Organizations using the Zapros library should prioritize updating to version 0.14.0 during the next maintenance cycle. By establishing a hard limit on decompression layers, the update effectively neutralizes the resource exhaustion vector, ensuring application stability against malicious server responses.