CVE-2026-61652: Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

Denial of service via memory exhaustion. Affects all callers who streamed compressed responses relying on the chunk size — explicit (iter_bytes(chunk_size=...)) or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compressed response could overflow memory.

import gzip, zapros