Zapros, a Python HTTP client, can be forced into a denial of service by a malicious response that includes an unbounded chain of Content‑Encoding headers. When the client follows a redirect or accepts data from an untrusted server, each layer of the encoding is decompressed, creating a deeply nested chain that consumes CPU and memory resources. The flaw is rated CVSS 6.9 and identified as CWE‑770, meaning it allows an attacker to exhaust system resources without authentication. The consequence is an application or service outage when the exhaustion occurs.

All installations of zapros prior to version 0.14.0 on any operating system are affected, regardless of how the client is used. The issue arises when the client receives responses from untrusted servers or follows redirects to external sites. Version 0.14.0 and later include a fix that limits encoding layers to five and raises a DecodingError when the limit is exceeded.

The CVSS score of 6.9 suggests a moderate severity. EPSS is not available and the vulnerability is not listed in CISA KEV. The likely attack vector is a malicious HTTP server or a compromised upstream service returning a response with many chained Content‑Encoding headers. Because the flaw is triggered by user input (the server response), any application that uses zapros to fetch data from untrusted sources is at risk until the client is hardened or updated.