CVE-2026-84378mediumCWE-407

CVE-2026-84378: medium-severity vulnerability in pydantic httpx2

HTTPX2: Quadratic SSE line buffering can cause CPU denial of service

Published

Follow this CVE+ Monitor httpx2+ Monitor httpx2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.9epss 0.3%
HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.py repeatedly copies and rescans buffered text in _SSELineDecoder.decode() when an attacker-controlled or compromised SSE endpoint splits one unterminated line across many response chunks. The behavior affects httpx2.Client.sse() and httpx2.AsyncClient.sse(), and the total processing work grows quadratically with the line length, allowing a crafted stream to consume excessive CPU and block a synchronous worker or asynchronous event loop. This issue is fixed in version 2.10.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
pydantic · httpx2
Related CVEs — pydantic httpx2

In the same product, most dangerous first.

CVE-2026-84382HIGHHTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)EPSS 0.6%CVE-2026-84379MEDIUMHTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headersEPSS 0.3%CVE-2026-84380MEDIUMHTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generatedEPSS 0.2%CVE-2026-84381HIGHHTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxiesEPSS 0.1%