Executive brief
HTTPX2 is a Python HTTP client library commonly used to fetch web content and consume server-sent events (SSE) for real-time data streaming. A defect in its SSE parser causes it to repeatedly copy and rescan buffered data when a server sends long lines split across many small chunks, resulting in quadratic CPU consumption. An attacker operating or compromising an SSE endpoint can exploit this to exhaust a client application's CPU and block its processing, degrading availability of services dependent on that client.
Technical details
The vulnerability is an algorithmic complexity flaw (CWE-407) in HTTPX2's SSE parsing logic used by both httpx2.Client.sse() and httpx2.AsyncClient.sse() methods. Before version 2.10.0, the parser combined the complete pending SSE line with each newly received chunk and then scanned the combined text for line separators. If a server sends a long unterminated line as many small chunks, every chunk causes all previously received text to be copied and rescanned, resulting in O(n²) processing complexity instead of linear. The attack vector is network-based and requires no privileges or user interaction; only an attacker-controlled or compromised SSE endpoint. The vulnerability does not affect confidentiality or integrity, only availability. The fix in version 2.10.0 accumulates line fragments and combines them only when necessary, making processing linear; it also enforces a default 1 MiB buffer limit via max_event_size.
Affected products
- Pydantic HTTPX2 >= 2.5.0, < 2.10.0
Timeline
- 2026-08-18: disclosed
- 2026-09-02: patched: Fix released in HTTPX2 2.10.0