CVE-2026-61541: Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Who is impacted:

• Any application using Zapros to make HTTP requests to untrusted servers
• Applications that follow redirects to attacker-controlled hosts

Attack vector:

• A malicious HTTP server returns a response with many chained content encodings. When the client attempts to decode, it creates a deeply nested decompression chain consuming excessive resources.