CVE-2026-84380: falha de média gravidade em pydantic httpx2
HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.6epss 0.2%
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault() processing checks each default header independently rather than treating the two framing headers as mutually exclusive. Fixed-size byte, JSON, form, and known-length multipart bodies can therefore be serialized over HTTP/1.1 with both headers, allowing request smuggling or connection desynchronization when downstream intermediaries disagree about which framing header takes precedence. This issue is fixed in version 2.11.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
pydantic · httpx2CVEs relacionadas — pydantic httpx2
No mesmo produto, das mais perigosas para as menos.
CVE-2026-84382HIGHHTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)EPSS 0.6%CVE-2026-84379MEDIUMHTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headersEPSS 0.3%CVE-2026-84378MEDIUMHTTPX2: Quadratic SSE line buffering can cause CPU denial of serviceEPSS 0.3%CVE-2026-84381HIGHHTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxiesEPSS 0.1%