80 matches found
ROOT-APP-PYPI-CVE-2026-84382 CVE-2026-84382 in httpx2 - Patched by Root
Root has patched CVE-2026-84382 in the httpx2 package for Root:PyPI. Multiple fixed versions available...
GHSA-H4X7-GW46-3WM6 vulnerabilities
Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...
GHSA-PF96-P4FJ-6566 vulnerabilities
Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...
CVE-2026-84382 vulnerabilities
Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...
GHSA-8XX6-HGC6-GC2M vulnerabilities
Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...
CVE-2026-84380 vulnerabilities
Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...
CVE-2026-84379 vulnerabilities
Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...
CVE-2026-84379 vulnerabilities
Vulnerabilities for packages: py3-httpx2...
CVE-2026-84380 vulnerabilities
Vulnerabilities for packages: py3-httpx2...
GHSA-H4X7-GW46-3WM6 vulnerabilities
Vulnerabilities for packages: py3-httpx2...
CVE-2026-84382 vulnerabilities
Vulnerabilities for packages: py3-httpx2...
GHSA-8XX6-HGC6-GC2M vulnerabilities
Vulnerabilities for packages: py3-httpx2...
GHSA-PF96-P4FJ-6566 vulnerabilities
Vulnerabilities for packages: py3-httpx2...
HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
SummaryHTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...
HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
SummaryHTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to...
PYSEC-2026-3849 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
Summary HTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...
PYSEC-2026-3848 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
Summary HTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to...
HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
SummaryWhen decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respons...
PYSEC-2026-3846 HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
Summary When decoding a compressed response body gzip, deflate, br, or zstd, HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the respon...
