ROOT-APP-PYPI-CVE-2026-84382 CVE-2026-84382 in httpx2 - Patched by Root

Root has patched CVE-2026-84382 in the httpx2 package for Root:PyPI. Multiple fixed versions available...

GHSA-H4X7-GW46-3WM6 vulnerabilities

Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...

GHSA-PF96-P4FJ-6566 vulnerabilities

Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...

GHSA-8XX6-HGC6-GC2M vulnerabilities

Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...

CVE-2026-84382 vulnerabilities

Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...

CVE-2026-84380 vulnerabilities

Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...

CVE-2026-84379 vulnerabilities

Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...

CVE-2026-84379 vulnerabilities

Vulnerabilities for packages: py3-httpx2...

CVE-2026-84380 vulnerabilities

Vulnerabilities for packages: py3-httpx2...

GHSA-H4X7-GW46-3WM6 vulnerabilities

Vulnerabilities for packages: py3-httpx2...

GHSA-8XX6-HGC6-GC2M vulnerabilities

Vulnerabilities for packages: py3-httpx2...

CVE-2026-84382 vulnerabilities

Vulnerabilities for packages: py3-httpx2...

GHSA-PF96-P4FJ-6566 vulnerabilities

Vulnerabilities for packages: py3-httpx2...

HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

SummaryHTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...

PYSEC-2026-3849 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

Summary HTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...

HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

SummaryHTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to...

PYSEC-2026-3848 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

Summary HTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to...

HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

SummaryWhen decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respons...

PYSEC-2026-3846 HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

Summary When decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respon...

HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies

Summaryhttpcore2 does not start TLS for wss:// connections routed through a SOCKS5 proxy. The WebSocket opening handshake and all subsequent frames are sent in plaintext through the proxy path, despite the caller selecting the secure wss scheme.The transport flaw affects httpcore2 releases before...