Skip to content
OpenAdvisories
Medium · 5.6 Public exploit CVE-2026-84380 EUVD-2026-70248GHSA-pf96-p4fj-6566PYSEC-2026-3849

HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

Published Sep 2, 2026 · Updated Sep 2, 2026 · Assigned by GitHub_M

Description

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault() processing checks each default header independently rather than treating the two framing headers as mutually exclusive. Fixed-size byte, JSON, form, and known-length multipart bodies can therefore be serialized over HTTP/1.1 with both headers, allowing request smuggling or connection desynchronization when downstream intermediaries disagree about which framing header takes precedence. This issue is fixed in version 2.11.0.

Affected products

VendorProductAffectedFixed
pydantic httpx2 < 2.11.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 python-httpx2 2.12.0-1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 python-httpx2 No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling py3.10-httpx2 +3 2.12.0-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI httpx2 < 2.11.0 2.11.0 GHSA-pf96-p4fj-6566

References