CVE-2026-84382 HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iterbytes or aiterbytes yields bounded pieces to the application. A 64 KiB compressed chunk can expa...

CVE-2026-84382

HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iterbytes or aiterbytes yields bounded pieces to the application. A 64 KiB compressed chunk can expa...

CVE-2026-84381

HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/sync/socksproxy.py and src/httpcore2/httpcore2/async/socksproxy.py when the remote origin uses wss through a SOCKS5 proxy because the TLS upgrade condition only recognizes...

CVE-2026-84380 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request.prepare in src/httpx2/httpx2/models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault processing checks each default head...

CVE-2026-84380 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request.prepare in src/httpx2/httpx2/models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault processing checks each default head...

CVE-2026-84380

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request.prepare in src/httpx2/httpx2/models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault processing checks each default head...

CVE-2026-84379 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...

CVE-2026-84379 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...

CVE-2026-84379

HTTPX2 , a next-generation HTTP client for Python, is affected by a multipart part header injection vulnerability in FileField.render_headers() within src/httpx2/httpx2/_multipart.py. Prior to 2.11.0 , attacker-controlled content_type values and custom headers from files= tuples are interpolated ...

CVE-2026-84379

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...

CVE-2026-84378 HTTPX2: Quadratic SSE line buffering can cause CPU denial of service

HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/sse.py repeatedly copies and rescans buffered text in SSELineDecoder.decode when an attacker-controlled or compromised SSE endpoint splits one unterminated line...

CVE-2026-84378

HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/sse.py repeatedly copies and rescans buffered text in SSELineDecoder.decode when an attacker-controlled or compromised SSE endpoint splits one unterminated line...

nodejs: Node.js: Request smuggling via HTTP client header truncation

A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application whi...

nodejs: Node.js: Request smuggling via HTTP client header truncation

A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application whi...

PT-2026-84846

Name of the Vulnerable Software and Affected Versions HTTPX2 versions prior to 2.11.0 Description The Request. prepare function in src/httpx2/httpx2/ models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. This occurs...

nodejs: Node.js: Request smuggling via HTTP client header truncation

A flaw was found in Node.js. The Node.js HTTP client can cause a request desynchronization in forwarding proxies, potentially leading to request smuggling. This vulnerability arises when the HTTP client omits certain headers, such as Content-Length, from being visible to the proxy application whi...

CVE-2026-55951

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...

AZL-98454 CVE-2026-55951 affecting package erlang for versions less than 26.2.5.21-6

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...

EEF-CVE-2026-55951 httpc memory exhaustion via unbounded response header accumulation

Summary The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after t...

CVE-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...