The Zapros Python HTTP client contains a critical memory exhaustion vulnerability that allows unauthenticated attackers to cause a denial of service on applications processing compressed responses.

This vulnerability, categorized as CWE-770 (Allocation of Resources Without Limits or Throttling), occurs because the library fails to enforce memory bounds when decompressing incoming data. An unauthenticated attacker can supply a malicious compressed response that triggers unbounded memory allocation, leading to a crash of the calling application.

Successful exploitation results in a denial of service, which can render critical applications unresponsive and unavailable to legitimate users. With a CVSS score of 8.7, this flaw represents a significant threat to service availability. Organizations relying on Zapros for automated data retrieval or API interaction face potential operational disruption and loss of service continuity.

Immediate Action: Update the zapros library to version 0.14.0 or later to apply the necessary memory limit patches.

Proactive Monitoring: Monitor application memory usage and process logs for sudden spikes or unexpected termination events that may indicate an attempt to trigger this memory exhaustion flaw.

Compensating Controls: If immediate patching is not feasible, modify application code to use Response.iter_raw() or Response.async_iter_raw() to process data without the vulnerable decoder, while implementing manual output-size bounds during decompression. Additionally, attempt to disable response compression by setting the Accept-Encoding: identity header in requests to untrusted servers.

Public Exploit Available: Unknown

Given the high CVSS severity and the ease of exploitation, upgrading to version 0.14.0 is mandatory for all environments utilizing the zapros library. Security teams should prioritize this update to prevent potential service instability caused by malicious compressed responses.