# CVE-2026-84378: HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.

Source: https://junglewise.ai/threats/cve-2026-84378-httpx2-quadratic-sse-line-buffering-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84378 · Severity: medium · CVSS 5.9 · Published 2026-09-02

HTTPX2 is a Python HTTP client library commonly used to fetch web content and consume server-sent events (SSE) for real-time data streaming. A defect in its SSE parser causes it to repeatedly copy and rescan buffered data when a server sends long lines split across many small chunks, resulting in quadratic CPU consumption. An attacker operating or compromising an SSE endpoint can exploit this to exhaust a client application's CPU and block its processing, degrading availability of services dependent on that client.

Technologies: [httpx2 (PyPI)](https://junglewise.ai/threats/technologies/httpx2). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-84378 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84378 being exploited in the wild.

**How severe is CVE-2026-84378?** Medium severity, with a CVSS score of 5.9, published 2 September 2026.

**Which products and versions are affected?** Encode HTTPX >= 2.5.0, < 2.10.0; httpx2 (PyPI) >= 2.5.0, < 2.10.0, ECOSYSTEM:introduced=2.5.0,fixed=2.10.0.

**Is there a fix for CVE-2026-84378?** Yes. httpx2 (PyPI): upgrade to 2.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84378 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-84378?** Check whether you run Encode HTTPX or httpx2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- httpx2 (PyPI): upgrade to 2.10.0 or later

  ```sh
  pip install "httpx2>=2.10.0"
  ```


## Technical details

The vulnerability is an algorithmic complexity flaw (CWE-407) in HTTPX2's SSE parsing logic used by both httpx2.Client.sse() and httpx2.AsyncClient.sse() methods. Before version 2.10.0, the parser combined the complete pending SSE line with each newly received chunk and then scanned the combined text for line separators. If a server sends a long unterminated line as many small chunks, every chunk causes all previously received text to be copied and rescanned, resulting in O(n²) processing complexity instead of linear. The attack vector is network-based and requires no privileges or user interaction; only an attacker-controlled or compromised SSE endpoint. The vulnerability does not affect confidentiality or integrity, only availability. The fix in version 2.10.0 accumulates line fragments and combines them only when necessary, making processing linear; it also enforces a default 1 MiB buffer limit via max_event_size.

## Affected products

- Pydantic HTTPX2 >= 2.5.0, < 2.10.0

## Identifiers

- CVE-2026-84378
- GHSA-f2fp-rgf2-35cp
- PYSEC-2026-3847

## Timeline

- 2026-08-18: disclosed
- 2026-09-02: patched: Fix released in HTTPX2 2.10.0

## References

- [https://api.github.com/users/GalaxySnail](https://api.github.com/users/GalaxySnail)
- [https://github.com/GalaxySnail](https://github.com/GalaxySnail)
- [https://api.github.com/users/GalaxySnail/gists%7B/gist_id%7D](https://api.github.com/users/GalaxySnail/gists%7B/gist_id%7D)
- [https://api.github.com/users/GalaxySnail/repos](https://api.github.com/users/GalaxySnail/repos)
- [https://avatars.githubusercontent.com/u/53637421?v=4](https://avatars.githubusercontent.com/u/53637421?v=4)
- [https://api.github.com/users/GalaxySnail/events%7B/privacy%7D](https://api.github.com/users/GalaxySnail/events%7B/privacy%7D)

## Related threats

- [Pydantic HTTPX2 decompression memory amplification](https://junglewise.ai/threats/cve-2026-84382-pydantic-httpx2-decompression-memory-amplification)
- [HTTPX2 secure WebSocket plaintext transmission via SOCKS proxy](https://junglewise.ai/threats/cve-2026-84381-httpx2-secure-websocket-plaintext-transmission-via-socks-proxy)
- [Pydantic HTTPX2 HTTP request smuggling via conflicting headers](https://junglewise.ai/threats/cve-2026-84380-pydantic-httpx2-http-request-smuggling-via-conflicting-headers)
- [HTTPX2 multipart header injection via unvalidated Content-Type and headers](https://junglewise.ai/threats/cve-2026-84379-httpx2-multipart-header-injection-via-unvalidated-content-type)