Advisories for Pypi/Zapros package

Denial of service via memory exhaustion. Affects all callers who streamed compressed responses relying on the chunk size — explicit (iter_bytes(chunk_size=…)) or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compressed response could overflow memory. import gzip, zapros

Who is impacted: Any application using Zapros to make HTTP requests to untrusted servers Applications that follow redirects to attacker-controlled hosts Attack vector: A malicious HTTP server returns a response with many chained content encodings. When the client attempts to decode, it creates a deeply nested decompression chain consuming excessive resources.