CVE-2026-84378mediumCWE-407

CVE-2026-84378: falha de média gravidade em pydantic httpx2

HTTPX2: Quadratic SSE line buffering can cause CPU denial of service

Publicada em

Seguir esta CVE+ Monitorar httpx2+ Monitorar httpx2

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.9epss 0.3%
HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.py repeatedly copies and rescans buffered text in _SSELineDecoder.decode() when an attacker-controlled or compromised SSE endpoint splits one unterminated line across many response chunks. The behavior affects httpx2.Client.sse() and httpx2.AsyncClient.sse(), and the total processing work grows quadratically with the line length, allowing a crafted stream to consume excessive CPU and block a synchronous worker or asynchronous event loop. This issue is fixed in version 2.10.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
pydantic · httpx2
CVEs relacionadas — pydantic httpx2

No mesmo produto, das mais perigosas para as menos.

CVE-2026-84382HIGHHTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)EPSS 0.6%CVE-2026-84379MEDIUMHTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headersEPSS 0.3%CVE-2026-84380MEDIUMHTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generatedEPSS 0.2%CVE-2026-84381HIGHHTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxiesEPSS 0.1%