CVE-2026-84380
Received Received - Intake

HTTP Request Smuggling in HTTPX2

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault() processing checks each default header independently rather than treating the two framing headers as mutually exclusive. Fixed-size byte, JSON, form, and known-length multipart bodies can therefore be serialized over HTTP/1.1 with both headers, allowing request smuggling or connection desynchronization when downstream intermediaries disagree about which framing header takes precedence. This issue is fixed in version 2.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84380
EUVD
EUVD-2026-70248

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
httpx2 httpx2 to 2.11.0 (exc)
pydantic httpx2 to 2.11.0 (exc)
pydantic httpx2 2.11.0
pydantic httpx2 2.12.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in HTTPX2 versions prior to 2.11.0. It involves improper handling of HTTP headers where a Content-Length header is automatically added to requests even when a caller-supplied Transfer-Encoding header is present. This creates conflicting framing headers in HTTP/1.1 requests, violating message-framing requirements.

Detection Guidance

To detect this vulnerability, inspect HTTP requests for conflicting Content-Length and Transfer-Encoding headers. Use tools like tcpdump or Wireshark to capture and analyze traffic for requests with both headers present. Check application logs for malformed requests or errors related to header processing.

Impact Analysis

An attacker could exploit this to perform request smuggling or connection desynchronization if downstream systems interpret the conflicting headers differently. This may lead to request interference, bypassed routing or authorization controls, or response or cache poisoning. Applications not forwarding untrusted Transfer-Encoding headers are less exposed.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR and HIPAA by enabling request smuggling or connection desynchronization attacks. Such attacks may allow unauthorized access to sensitive data, manipulation of requests, or bypassing security controls, which could violate data protection requirements under GDPR or compromise protected health information under HIPAA.

Mitigation Strategies

Upgrade HTTPX2 to version 2.11.0 or later to fix the issue. If upgrading is not possible, ensure untrusted Transfer-Encoding headers are removed before constructing requests. Proxy applications should derive framing headers from the body instead of forwarding inbound headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84380. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart