CVE-2026-84378: HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.

CVE-2026-84378 · Severity: medium · CVSS 5.9 · Published 2026-09-02

HTTPX2 is a Python HTTP client library commonly used to fetch web content and consume server-sent events (SSE) for real-time data streaming. A defect in its SSE parser causes it to repeatedly copy and rescan buffered data when a server sends long lines split across many small chunks, resulting in quadratic CPU consumption. An attacker operating or compromising an SSE endpoint can exploit this to exhaust a client application's CPU and block its processing, degrading availability of services dependent on that client.

Technologies: httpx2 (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-84378 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84378 being exploited in the wild.
How severe is CVE-2026-84378?
Medium severity, with a CVSS score of 5.9, published 2 September 2026.
Which products and versions are affected?
Encode HTTPX >= 2.5.0, < 2.10.0; httpx2 (PyPI) >= 2.5.0, < 2.10.0, ECOSYSTEM:introduced=2.5.0,fixed=2.10.0.
Is there a fix for CVE-2026-84378?
Yes. httpx2 (PyPI): upgrade to 2.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84378 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-84378?
Check whether you run Encode HTTPX or httpx2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • httpx2 (PyPI): upgrade to 2.10.0 or later
    pip install "httpx2>=2.10.0"

Technical details

The vulnerability is an algorithmic complexity flaw (CWE-407) in HTTPX2's SSE parsing logic used by both httpx2.Client.sse() and httpx2.AsyncClient.sse() methods. Before version 2.10.0, the parser combined the complete pending SSE line with each newly received chunk and then scanned the combined text for line separators. If a server sends a long unterminated line as many small chunks, every chunk causes all previously received text to be copied and rescanned, resulting in O(n²) processing complexity instead of linear. The attack vector is network-based and requires no privileges or user interaction; only an attacker-controlled or compromised SSE endpoint. The vulnerability does not affect confidentiality or integrity, only availability. The fix in version 2.10.0 accumulates line fragments and combines them only when necessary, making processing linear; it also enforces a default 1 MiB buffer limit via max_event_size.

Affected products

  • Pydantic HTTPX2 >= 2.5.0, < 2.10.0

Identifiers

  • CVE-2026-84378
  • GHSA-f2fp-rgf2-35cp
  • PYSEC-2026-3847

Timeline

  • 2026-08-18: disclosed
  • 2026-09-02: patched: Fix released in HTTPX2 2.10.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.