HTTPX2 flaw can crash Python applications

Published September 8, 2026 CVE-2026-84382

A malicious server response can exhaust memory and stop applications using HTTPX2. The attacker needs no login or further user action.

Severity
HighCVSS 3.1 · 7.5
Fix
Fixed in 2.12.0
Affected versions
before 2.12.0
Weakness
CWE-409
Exploit likelihood
0.35% in 30 daysEPSS, higher than 28% of known flaws
Affects
HTTPX2

How it works

  • An application requests content from an attacker-controlled or compromised server.
  • The server returns a malicious compressed response.
  • HTTPX2 before 2.12.0 fully decompresses each received piece before passing it onward.
  • A 64 KiB compressed piece can become about 64 MiB during decompression.
  • The resulting memory pressure can terminate the application process.

What to do

Run python3 -m pip show httpx2 in the application's Python environment. Check the Version line. Versions below 2.12.0 are affected. No result only means that environment does not contain the package.

Run this in the application environment you want to check:

python3 -m pip show httpx2

Upgrade HTTPX2 to version 2.12.0 or later through the application's normal dependency process. Run the check again and confirm it reports 2.12.0 or later.

Technical details

HTTPX2 before 2.12.0 fully decompressed every gzip, deflate, Brotli, or Zstandard network piece before returning smaller pieces to the application. Streaming therefore did not limit peak memory use. A 64 KiB compressed piece could temporarily require about 64 MiB. Version 2.12.0 processes decompressed output incrementally with bounded intermediate buffers.

The advisory supports service disruption, but not data theft or unauthorized changes.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact None No data disclosure
  • Integrity impact None No data tampering
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Open in FIRST.org calculator

References

View Original Source