kap-sh vulnerabilities

Products

• zapros 2

Latest kap-sh CVEs

Newest publication first

1. CVE-2026-61541 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

   Published 2026-09-21

   Medium·CVSS 6.9 EPSS 0.43%

   Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values cau...

2. CVE-2026-61652 Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

   Published 2026-09-21

   High·CVSS 8.7 EPSS 0.44%

   Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed responses relying on the chunk size — explicit (iter_bytes(chunk_size=...)) or the default — to bound memory. The...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.