Executive brief
HTTPX2 is a Python HTTP client library used by applications to make web requests, including file uploads. When applications accept user-provided metadata for file uploads (such as file type or custom headers) and pass it directly to HTTPX2, an attacker can inject CRLF characters to add fake headers to the multipart form body. This allows manipulation of how upload servers interpret the uploaded file, potentially bypassing validation checks or altering file semantics.
Technical details
The vulnerability is a CRLF injection flaw (CWE-93) in HTTPX2's `FileField.render_headers()` method. When serializing multipart form-data via the `files=` tuple API (accepting either three or four elements), the library interpolates user-supplied `content_type` and custom `headers` values directly between CRLF delimiters without validation. An attacker can craft input like `"text/plain\r\nX-Injected: true"` in the content-type parameter or header values to terminate the part header block early and inject arbitrary headers. Filenames and field names are properly escaped and not vulnerable. The injected headers remain within the multipart body and do not split the outer HTTP message; downstream multipart parsers determine the actual security impact. Patched versions (2.11.0+) validate and reject forbidden control characters (NUL, CR, LF, C0 controls except horizontal tab, and DEL) before serializing the request, raising `ValueError` on malicious input.
Affected products
- Pydantic HTTPX2 < 2.11.0
Timeline
- 2026-08-18: disclosed: Initial security advisory published by Pydantic/HTTPX2
- 2026-09-02: advisory: Published to National Vulnerability Database
- 2026-09-08: advisory: Published to GitHub Advisory Database
- 2026-09-08: patched: Fix released in HTTPX2 version 2.11.0