Skip to content
OpenAdvisories

Package · Wolfi

py3.12-httpx2

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.5
    CVE-2026-84382

    HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

    HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iter_bytes() or aiter_bytes() yields bounded pieces to the ap…

    pydantic httpx2 httpx2 python-httpx2 Debian Ubuntu Wolfi PyPI
  • Medium 5.6
    CVE-2026-84380 Public exploit

    HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

    HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setd…

    pydantic httpx2 python-httpx2 httpx2 Debian Ubuntu Wolfi PyPI
  • Medium 5.3
    CVE-2026-84379

    HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

    HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attacker-controlled content_type values and custom headers from the files= three-element (filename, conten…

    pydantic httpx2 httpx2 python-httpx2 Debian Ubuntu Wolfi PyPI