Zapros, a Python HTTP client, is susceptible to a denial‑of‑service flaw when it streams compressed responses. The streaming decoders ignore the requested chunk size, allowing an attacker to send a single compressed chunk that vastly exceeds the expected size. This results in unbounded memory allocation, exhausting system RAM and causing the client to crash or become unresponsive. The weakness is an unchecked allocation based on input data, classic buffer‑size overflow (CWE‑770).

The Zapros HTTP client from kap-sh is affected for all releases before version 0.14.0, including those that use the default or explicit chunk‑sized streaming API. All calls that rely on the client’s automatic decompression will be impacted unless the caller opts to bypass the built‑in decoder.

The vulnerability is rated 8.7 on the CVSS scale; it is a high‑severity denial‑of‑service flaw. No EPSS data is available and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is a remote malicious server that sends a decompressed response compressed with a large chunk size to an instance of Zapros. When the client attempts to stream that response, it will allocate unbounded memory, potentially exhausting system resources and rendering the client (or host) unusable. Given the missing EPSS data, the exploitation probability remains uncertain but the impact is severe for any affected deployment.