{"items":[{"id":"NVI-00013174","kind":"vulnerability","title":"Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-6cp7-3m3c-5x5c","CVE-2026-61652"],"plain_summary":"GitHub lists this reviewed advisory for zapros. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-853a5910bde58a4d721bb5192baadc7e"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-853a5910bde58a4d721bb5192baadc7e","url":"https://github.com/advisories/GHSA-6cp7-3m3c-5x5c","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-6cp7-3m3c-5x5c","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:25:10.521Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-853a5910bde58a4d721bb5192baadc7e"],"technology":"zapros","known_exclusions":[],"conditions_summary":"### Impact\n\nDenial of service via memory exhaustion. Affects all callers who streamed compressed responses relying on the chunk size — explicit (`iter_bytes(chunk_size=...)`) or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compressed response could overflow memory.\n\n```python\nimport gzip, zapros\n\n# Server returns ~1 GiB of zeros gzip-compressed to ~1 MiB,\n# with header: Content-Encoding: gzip\nbomb = gzip.compress(b\"\\0\" * 1_000_000_000)  # ~1 MiB on the wire\n\nwith zapros.stream(\"GET\", \"https://malicious.example/bomb\") as response:\n    # Caller asks for 8 KiB chunks, expecting bounded memory:\n    for chunk in response.iter_bytes(chunk_size=8192):\n        ...  # first `chunk` is ~1 GiB, not 8 KiB -> memory exhaustion\n```\n\n### Patches\n\nUpgrade to `0.14.0` or later. The decoders now bound the output of each decompression step to the requested `chunk_size`: gzip/deflate via `zlib`'s `max_length` + `unconsumed_tail`, brotli via `output_buffer_limit`, and zstd via a bounded `stream_writer`. Peak memory during streaming decode is now proportional to `chunk_size` for all supported encodings.\n\n### Workarounds\n\nFor un","public_affected_ranges":["< 0.14.0"]}],"null_published_at":"2026-11-01T07:29:12.927Z","source_updated_at":"2026-09-23T13:57:50.000Z","source_disclosed_at":"2026-09-23T13:57:48.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T07:25:10.521Z"}],"next_cursor":null,"snapshot_revision":"42594"}