CVE-2026-84382
Received Received - Intake

HTTPX2 Memory Exhaustion via Compressed Response Decoding

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iter_bytes() or aiter_bytes() yields bounded pieces to the application. A 64 KiB compressed chunk can expand to approximately 64 MiB in one intermediate allocation, so an attacker-controlled or compromised server can cause severe memory pressure or out-of-memory process termination even when the application streams the response. This issue is fixed in version 2.12.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84382
EUVD
EUVD-2026-70251

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pydantic httpx2 to 2.12.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-84382 is a vulnerability in HTTPX2 versions prior to 2.12.0 where streaming response decompression does not properly bound peak memory usage. When HTTPX2 decodes compressed response bodies like gzip, deflate, br, or zstd, it fully decompresses each network read before yielding content to the application. This means a small compressed input could result in a large intermediate memory allocation, even if the application streams the response.

Detection Guidance

To detect this vulnerability, check if your system uses HTTPX2 versions prior to 2.12.0. Run: pip show httpx2. If the version is below 2.12.0, the system is vulnerable. Additionally, monitor for unusual memory usage spikes when processing compressed HTTP responses.

Impact Analysis

An attacker-controlled or compromised server can cause severe memory pressure or out-of-memory process termination by sending malicious compressed responses. Applications fetching resources from untrusted servers, such as webhook receivers or crawlers, are at risk. No authentication or user interaction is required beyond making a request.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service attacks through memory exhaustion. If exploited, it may cause service disruptions or crashes in systems processing compressed HTTP responses from untrusted sources, potentially violating availability requirements in GDPR (Article 32) and HIPAA (Security Rule §164.308(a)(7)). However, the primary risk is operational rather than direct data exposure.

Mitigation Strategies

Upgrade HTTPX2 to version 2.12.0 or later immediately. Use pip install --upgrade httpx2. If upgrading is not possible, avoid processing compressed responses from untrusted sources or implement custom decompression with bounded memory limits.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84382. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart