CVE-2026-84379Medium· 5.3▾ SunlitHTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attacker-controlled content_type values and custom headers from the files= three-ele…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attacker-controlled content_type values and custom headers from the files= three-element (filename, content, content_type) tuple and the files= four-element (filename, content, content_type, headers) tuple into multipart/form-data part headers without validating header names or values. CR or LF characters can terminate a part header, inject additional part headers, or end the part header block early, allowing a downstream multipart parser to treat attacker-supplied lines as genuine headers and potentially alter part semantics or bypass header-based checks. This issue is fixed in version 2.11.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
httpx2 < 2.11.0Patched in:
httpx2 2.11.0Source: https://osv.dev/vulnerability/GHSA-h4x7-gw46-3wm6
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84382High· 7.5HTTPX2 is a next generation HTTP client for Python
CVE-2026-84380Medium· 5.6HTTPX2 is a next generation HTTP client for Python
CVE-2026-84378Medium· 5.9HTTPX2 is a next generation HTTP client for Python
CVE-2024-58384Medium· 5.4Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers
CVE-2026-67326High· 7.0GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config
CVE-2026-93576High· 7.5A flaw was found in Netty netty-codec-smtp