zapros 0.2.0

Direct Vulnerabilities

Known vulnerabilities in the zapros package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Allocation of Resources Without Limits or Throttling zapros is a Modern and extensible HTTP client for Python. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via `_get_content_decoder` in `src/zapros/_models.py`, where an attacker can send an HTTP response with an unbounded number of `Content-Encoding` layers, causing the client to attempt to instantiate a decoder for each layer and exhaust resources. The fix enforces a hard limit of five decoding layers, raising a `DecodingError` when the limit is exceeded. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `zapros` to version 0.14.0 or higher.	[,0.14.0)
H Allocation of Resources Without Limits or Throttling zapros is a Modern and extensible HTTP client for Python. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via decompression of streaming responses in `_decoders.py`, where compressed content (gzip, deflate, or brotli) is decompressed without any limit on the output size. An attacker who controls or intercepts a server response can send a zip bomb - a small compressed payload that expands to an enormous amount of data - causing the process to exhaust available memory and crash. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `zapros` to version 0.14.0 or higher.	[,0.14.0)

Vulnerability

Vulnerable Version

Allocation of Resources Without Limits or Throttling

zapros is a Modern and extensible HTTP client for Python.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via _get_content_decoder in src/zapros/_models.py, where an attacker can send an HTTP response with an unbounded number of Content-Encoding layers, causing the client to attempt to instantiate a decoder for each layer and exhaust resources. The fix enforces a hard limit of five decoding layers, raising a DecodingError when the limit is exceeded.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade zapros to version 0.14.0 or higher.

[,0.14.0)

Allocation of Resources Without Limits or Throttling

zapros is a Modern and extensible HTTP client for Python.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via decompression of streaming responses in _decoders.py, where compressed content (gzip, deflate, or brotli) is decompressed without any limit on the output size. An attacker who controls or intercepts a server response can send a zip bomb - a small compressed payload that expands to an enormous amount of data - causing the process to exhaust available memory and crash.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade zapros to version 0.14.0 or higher.

[,0.14.0)

zapros@0.2.0

Modern and extensible HTTP client for Python.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically