AIKIDO-2026-512602

TL;DR

aiosonic transparently decompresses Content-Encoding: gzip and deflate response bodies with one-shot gzip.decompress()/zlib.decompress() calls over the entire buffer and no output-size limit. A malicious or compromised server can return a small compressed payload that inflates to hundreds of megabytes or gigabytes, exhausting memory in the client process and crashing it. Decompression happens in the request path before the response object is returned, so callers cannot inspect headers and opt out, and no special option is required. The fix switches to bounded streaming decompression with a configurable maximum size and raises a new DecompressionError on overflow.