CVE-2026-84378
Received Received - Intake

HTTPX2 Server-Sent Events Parser Quadratic CPU DoS

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.py repeatedly copies and rescans buffered text in _SSELineDecoder.decode() when an attacker-controlled or compromised SSE endpoint splits one unterminated line across many response chunks. The behavior affects httpx2.Client.sse() and httpx2.AsyncClient.sse(), and the total processing work grows quadratically with the line length, allowing a crafted stream to consume excessive CPU and block a synchronous worker or asynchronous event loop. This issue is fixed in version 2.10.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84378
EUVD
EUVD-2026-70242

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
pydantic httpx2 From 2.5.0 (inc) to 2.10.0 (inc)
pydantic httpx2 2.10.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects HTTPX2 versions 2.5.0 to 2.9.0. It involves a Server-Sent Events (SSE) parser issue where an attacker splits an unterminated line across many response chunks. The parser repeatedly copies and rescans buffered text, causing O(n²) processing time. This leads to excessive CPU usage and can block synchronous workers or asynchronous event loops.

Detection Guidance

To detect this vulnerability, monitor CPU usage spikes during SSE processing. Check for httpx2 versions between 2.5.0 and 2.9.0. Use commands like 'pip show httpx2' to verify installed versions. Inspect network traffic for fragmented SSE responses with unterminated lines.

Impact Analysis

The vulnerability can cause denial-of-service by consuming excessive CPU resources, potentially freezing applications using HTTPX2 for SSE processing. It does not impact confidentiality or integrity but may disrupt service availability.

Compliance Impact

This vulnerability primarily causes denial-of-service conditions by consuming excessive CPU and memory resources, which could lead to service unavailability. It does not directly affect confidentiality or integrity of data, so it may not directly violate GDPR or HIPAA requirements. However, prolonged unavailability could impact compliance with availability-related provisions in these regulations.

Mitigation Strategies

Upgrade httpx2 to version 2.10.0 or later using 'pip install --upgrade httpx2'. If upgrading is not possible, limit SSE consumption to trusted endpoints or enforce external size/time limits on responses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84378. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart