HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

SummaryWhen decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respons...

PYSEC-2026-3846 HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

Summary When decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respon...

HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

Summary When decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respon...

GHSA-8XX6-HGC6-GC2M HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

Summary When decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respon...

Linux Distros Unpatched Vulnerability : CVE-2026-84382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/decoders.py fully inflate each gzip,...

CVE-2026-84382

HTTPX2 , a next-generation HTTP client for Python, contains a decompression amplification flaw in its content decoders (src/httpx2/httpx2/_decoders.py). Prior to 2.12.0 , the decoders fully inflate each gzip, deflate, br, or zstd network chunk before yielding bounded pieces via iter_bytes() or ai...

CVE-2026-84382 HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iterbytes or aiterbytes yields bounded pieces to the application. A 64 KiB compressed chunk can expa...