143 matches found
HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
Summary When decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respon...
GHSA-8XX6-HGC6-GC2M HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
Summary When decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respon...
bio-corgi (0.4.0), sepal-ui (>=2.10.1, <=2.10.2) potentially affected by CVE-2026-84382 via httpx2 (0.0.0)
httpx2 PYPI version 0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on httpx2 and may be impacted: - bio-corgi 0.4.0 - sepal-ui =2.10.1, =2.10.2 Source cves: CVE-2026-84382 Source advisory: OSV:GHSA-8XX6-HGC6-GC2M...
Data Amplification
Overview httpx2 is a The next generation HTTP client. Affected versions of this package are vulnerable to Data Amplification in the default transport's response decompression, which inflates each network read of up to 64 KiB completely into a single intermediate allocation before yielding any...
bio-corgi (0.4.0), sepal-ui (>=2.10.1, <=2.10.2) potentially affected by CVE-2026-84380 via httpx2 (0.0.0)
httpx2 PYPI version 0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on httpx2 and may be impacted: - bio-corgi 0.4.0 - sepal-ui =2.10.1, =2.10.2 Source cves: CVE-2026-84380 Source advisory: OSV:GHSA-PF96-P4FJ-6566...
aetherpost (>=1.1.0, <=1.9.0), afterdark-llm-firewall (0.1.0) +156 more potentially affected by CVE-2026-84380 via httpx2 (>=2.2.0, <=2.10.0)
httpx2 PYPI version =2.2.0, =1.1.0, =0.1.5, =0.1.12, =1.3.155, =0.0.2, =0.2.0, =0.1.0, =0.1.1, =0.1.2, =0.8.3, =0.3.4, =0.1.0, =0.0.1, =0.1.8, =0.1.12 and more Source cves: CVE-2026-84380 Source advisory: SNYK:PYTHON-HTTPX2-20361639...
aetherpost (>=1.1.0, <=1.9.0), afterdark-llm-firewall (0.1.0) +156 more potentially affected by CVE-2026-84380 via httpx2 (>=2.2.0, <=2.10.0)
httpx2 PYPI version =2.2.0, =1.1.0, =0.1.5, =0.1.12, =1.3.155, =0.0.2, =0.2.0, =0.1.0, =0.1.1, =0.1.2, =0.8.3, =0.3.4, =0.1.0, =0.0.1, =0.1.8, =0.1.12 and more Source cves: CVE-2026-84380 Source advisory: GHSA-PF96-P4FJ-6566...
HTTP Request Smuggling
Overview httpx2 is a The next generation HTTP client. Affected versions of this package are vulnerable to HTTP Request Smuggling in Request.prepare, which applies a generated Content-Length header through setdefault whenever the body size is known, without checking whether the caller has already...
HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
Summary HTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...
EUVD-2026-70248
HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated...
GHSA-PF96-P4FJ-6566 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
Summary HTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...
aetherpost (>=1.1.0, <=1.9.0), afterdark-llm-firewall (0.1.0) +156 more potentially affected by CVE-2026-84380 via httpx2 (>=2.2.0, <=2.10.0)
httpx2 PYPI version =2.2.0, =1.1.0, =0.1.5, =0.1.12, =1.3.155, =0.0.2, =0.2.0, =0.1.0, =0.1.1, =0.1.2, =0.8.3, =0.3.4, =0.1.0, =0.0.1, =0.1.8, =0.1.12 and more Source cves: CVE-2026-84380 Source advisory: OSV:GHSA-PF96-P4FJ-6566...
bio-corgi (0.4.0), sepal-ui (>=2.10.1, <=2.10.2) potentially affected by CVE-2026-84379 via httpx2 (0.0.0)
httpx2 PYPI version 0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on httpx2 and may be impacted: - bio-corgi 0.4.0 - sepal-ui =2.10.1, =2.10.2 Source cves: CVE-2026-84379 Source advisory: OSV:GHSA-H4X7-GW46-3WM6...
aetherpost (>=1.1.0, <=1.9.0), afterdark-llm-firewall (0.1.0) +156 more potentially affected by CVE-2026-84379 via httpx2 (>=2.2.0, <=2.10.0)
httpx2 PYPI version =2.2.0, =1.1.0, =0.1.5, =0.1.12, =1.3.155, =0.0.2, =0.2.0, =0.1.0, =0.1.1, =0.1.2, =0.8.3, =0.3.4, =0.1.0, =0.0.1, =0.1.8, =0.1.12 and more Source cves: CVE-2026-84379 Source advisory: SNYK:PYTHON-HTTPX2-20361638...
aetherpost (>=1.1.0, <=1.9.0), afterdark-llm-firewall (0.1.0) +156 more potentially affected by CVE-2026-84379 via httpx2 (>=2.2.0, <=2.10.0)
httpx2 PYPI version =2.2.0, =1.1.0, =0.1.5, =0.1.12, =1.3.155, =0.0.2, =0.2.0, =0.1.0, =0.1.1, =0.1.2, =0.8.3, =0.3.4, =0.1.0, =0.0.1, =0.1.8, =0.1.12 and more Source cves: CVE-2026-84379 Source advisory: OSV:GHSA-H4X7-GW46-3WM6...
CRLF Injection
Overview httpx2 is a The next generation HTTP client. Affected versions of this package are vulnerable to CRLF Injection in the FileField.renderheaders method, which writes the per file contenttype value and any custom header names and values into the multipart part header block without rejecting...
aetherpost (>=1.1.0, <=1.9.0), afterdark-llm-firewall (0.1.0) +156 more potentially affected by CVE-2026-84379 via httpx2 (>=2.2.0, <=2.10.0)
httpx2 PYPI version =2.2.0, =1.1.0, =0.1.5, =0.1.12, =1.3.155, =0.0.2, =0.2.0, =0.1.0, =0.1.1, =0.1.2, =0.8.3, =0.3.4, =0.1.0, =0.0.1, =0.1.8, =0.1.12 and more Source cves: CVE-2026-84379 Source advisory: GHSA-H4X7-GW46-3WM6...
HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
Summary HTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to...
GHSA-H4X7-GW46-3WM6 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
Summary HTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to...