CVE-2026-84379
Received Received - Intake

HTTPX2 Python Library Multipart Header Injection Vulnerability

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attacker-controlled content_type values and custom headers from the files= three-element (filename, content, content_type) tuple and the files= four-element (filename, content, content_type, headers) tuple into multipart/form-data part headers without validating header names or values. CR or LF characters can terminate a part header, inject additional part headers, or end the part header block early, allowing a downstream multipart parser to treat attacker-supplied lines as genuine headers and potentially alter part semantics or bypass header-based checks. This issue is fixed in version 2.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84379
EUVD
EUVD-2026-70246

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
httpx2 httpx2 to 2.11.0 (exc)
pydantic httpx2 to 2.11.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects HTTPX2, a Python HTTP client library. It allows attackers to inject CR or LF characters into multipart/form-data part headers by manipulating file Content-Type values or custom headers. This can terminate part headers prematurely, inject additional headers, or alter part semantics without splitting the outer HTTP request.

Detection Guidance

To detect this vulnerability, check if your system uses HTTPX2 versions prior to 2.11.0. Run: pip show httpx2 or pip list | grep httpx2. If the version is below 2.11.0, the system is vulnerable.

Impact Analysis

An attacker could bypass server-side checks based on part headers, alter file semantics in multipart requests, or inject malicious headers. This may lead to unauthorized data access, request manipulation, or application logic changes depending on how the server processes multipart requests.

Mitigation Strategies

Upgrade HTTPX2 to version 2.11.0 or later using pip install --upgrade httpx2. If upgrading is not possible, validate custom headers and content types before passing them to HTTPX2 to reject control characters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84379. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart