[SECURITY] Fedora 44 Update: python-httpx2-2.13.1-1.fc44

HTTPX2 is a fully featured HTTP client library for Python. It includes an integrated command line client, has support for both HTTP/1.1 and HTTP/2, and provides both sync and async APIs...

Fedora 44 : python-httpx2 (2026-a69588e2cd)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a69588e2cd advisory. Update httpcore2 and httpx2 to 2.13.1. This is a security fix for CVE-2026-84378, CVE-2026-84379, and CVE-2026-84380. Tenable has extracted the...

ROOT-APP-PYPI-CVE-2026-84382 CVE-2026-84382 in httpx2 - Patched by Root

Root has patched CVE-2026-84382 in the httpx2 package for Root:PyPI. Multiple fixed versions available...

CVE-2026-84379 vulnerabilities

Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...

CVE-2026-84380 vulnerabilities

Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...

GHSA-H4X7-GW46-3WM6 vulnerabilities

Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...

GHSA-PF96-P4FJ-6566 vulnerabilities

Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...

GHSA-8XX6-HGC6-GC2M vulnerabilities

Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...

CVE-2026-84382 vulnerabilities

Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...

GHSA-H4X7-GW46-3WM6 vulnerabilities

Vulnerabilities for packages: py3-httpx2...

GHSA-8XX6-HGC6-GC2M vulnerabilities

Vulnerabilities for packages: py3-httpx2...

CVE-2026-84379 vulnerabilities

Vulnerabilities for packages: py3-httpx2...

CVE-2026-84382 vulnerabilities

Vulnerabilities for packages: py3-httpx2...

GHSA-PF96-P4FJ-6566 vulnerabilities

Vulnerabilities for packages: py3-httpx2...

CVE-2026-84380 vulnerabilities

Vulnerabilities for packages: py3-httpx2...

HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

SummaryHTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...

HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

SummaryHTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to...

PYSEC-2026-3848 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

Summary HTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to...

PYSEC-2026-3849 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

Summary HTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...

PYSEC-2026-3846 HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

Summary When decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respon...