{"id":"CVE-2021-41945","title":"Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.","summary":"Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-20"],"vendor":"encode","product":"httpx","affected":["httpx < 0.23.0"],"patched":["httpx 0.23.0"],"published":"2022-04-28","updated":"2026-07-05","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-41945","references":[{"url":"https://gist.github.com/lebr0nli/4edb76bbd3b5ff993cf44f2fbce5e571","label":"cve@mitre.org"},{"url":"https://github.com/encode/httpx","label":"cve@mitre.org"},{"url":"https://github.com/encode/httpx/discussions/1831","label":"cve@mitre.org"},{"url":"https://github.com/encode/httpx/issues/2184","label":"cve@mitre.org"},{"url":"https://github.com/encode/httpx/releases/tag/0.23.0","label":"cve@mitre.org"},{"url":"http://encode.com","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://gist.github.com/lebr0nli/4edb76bbd3b5ff993cf44f2fbce5e571","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/encode/httpx","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/encode/httpx/discussions/1831","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/encode/httpx/issues/2184","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/encode/httpx/releases/tag/0.23.0","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.02178,"epssPercentile":0.81569,"ingestedAt":"2026-07-06T17:03:24.174Z","slug":"CVE-2021-41945","body":"## Overview\n\nEncode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.\n\n## Affected\n\n- `httpx < 0.23.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `httpx 0.23.0`","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}