CVE-2026-84382High· 7.5▾ TwilightHTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iter_bytes() or aiter_bytes() yields bo…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iter_bytes() or aiter_bytes() yields bounded pieces to the application. A 64 KiB compressed chunk can expand to approximately 64 MiB in one intermediate allocation, so an attacker-controlled or compromised server can cause severe memory pressure or out-of-memory process termination even when the application streams the response. This issue is fixed in version 2.12.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
httpx2 < 2.12.0Patched in:
httpx2 2.12.0Source: https://osv.dev/vulnerability/GHSA-8xx6-hgc6-gc2m
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84379Medium· 5.3HTTPX2 is a next generation HTTP client for Python
CVE-2026-84378Medium· 5.9HTTPX2 is a next generation HTTP client for Python
CVE-2026-84380Medium· 5.6HTTPX2 is a next generation HTTP client for Python
CVE-2026-59200High· 7.5Pillow: Pillow: Denial of service via crafted PDF stream (CVE-2026-59200)
CVE-2026-49855High· 7.5tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption (CVE-2026-49855)
CVE-2026-44432High· 7.5urllib3 is an HTTP client library for Python