Zapros 0.14.0 Bounds Decompression Processing
Tech GuruQuick Answer
Zapros 0.14.0 fixes two denial-of-service paths when processing compressed HTTP responses. CVE-2026-61652 allowed a decoded streaming chunk to grow beyond the requested chunk size; CVE-2026-61541 allowed an excessive chain of content encodings. Applications that fetch untrusted servers or follow redirects to them should update the actual deployed dependency and retain independent limits on total response size and processing time.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory Zapros releases before 0.14.0, match the exact affected release or feature, apply the authority-supported fixed build or service remediation, validate the dependent workflow, and preserve evidence.
Source recheck: October 2, 2026 UTC. The linked project advisories were checked for this revision; deployment applicability and successful remediation still require local evidence. Recheck the supported release before changing production.
Scope And Authority
| Product scope | Zapros releases before 0.14.0 |
|---|---|
| Advisory | GHSA-6cp7-3m3c-5x5c / GHSA-5vjj-2r48-q622 |
| CVEs | CVE-2026-61541, CVE-2026-61652 |
| Authoritative release date | 2026-06-23 UTC (project advisory dates, not database ingestion) |
| Authority revision date | 2026-07-10 UTC (project advisory dates, not database ingestion) |
| Affected versions | Zapros releases before 0.14.0 |
| Fixed version | Zapros 0.14.0 |
| CVSS base score | GitHub Advisory Database CVSS v4 scores: CVE-2026-61652 8.7; CVE-2026-61541 6.9. The primary project JSON records do not provide numeric scores. |
| CVSS severity | Medium to High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The first fix bounds each streaming decompression step; it does not make accumulating every returned chunk into one unlimited object safe. The second rejects more than five Content-Encoding layers with DecodingError. A small compressed download can still represent much more decoded data. Do not rely solely on Accept-Encoding: identity against an untrusted server; verify the response policy before decoding, or use the project's raw-response approach with an explicitly bounded decoder until updated.
What To Validate Now
- Inventory. Record the installed Zapros version inside each application/worker, synchronous and asynchronous streaming consumers, redirect policy, accepted encodings and total-response limits.
- Establish applicability. Compare each deployment with the authority's affected-version statement: Zapros releases before 0.14.0 Do not infer applicability from product family or severity alone.
- Remediate. Apply Zapros 0.14.0 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Use small synthetic compressed fixtures in an isolated process with memory/time limits to verify ordinary decoding, bounded chunk output and excessive-layer rejection. Confirm safe error handling and redirect policy. Do not generate gigabyte-scale decompression bombs or test memory exhaustion on production workers.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
