CVE-2026-84379: HTTPX2 multipart header injection via unvalidated Content-Type and headers

CVE-2026-84379 · Severity: medium · CVSS 5.3 · Published 2026-09-02

HTTPX2 is a Python HTTP client library used by applications to make web requests, including file uploads. When applications accept user-provided metadata for file uploads (such as file type or custom headers) and pass it directly to HTTPX2, an attacker can inject CRLF characters to add fake headers to the multipart form body. This allows manipulation of how upload servers interpret the uploaded file, potentially bypassing validation checks or altering file semantics.

Technologies: httpx2 (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-84379 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84379 being exploited in the wild.
How severe is CVE-2026-84379?
Medium severity, with a CVSS score of 5.3, published 2 September 2026.
Which products and versions are affected?
httpx2 (PyPI) < 2.11.0, ECOSYSTEM:introduced=0,fixed=2.11.0.
Is there a fix for CVE-2026-84379?
Yes. httpx2 (PyPI): upgrade to 2.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84379 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-84379?
Check whether you run httpx2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • httpx2 (PyPI): upgrade to 2.11.0 or later
    pip install "httpx2>=2.11.0"

Technical details

The vulnerability is a CRLF injection flaw (CWE-93) in HTTPX2's `FileField.render_headers()` method. When serializing multipart form-data via the `files=` tuple API (accepting either three or four elements), the library interpolates user-supplied `content_type` and custom `headers` values directly between CRLF delimiters without validation. An attacker can craft input like `"text/plain\r\nX-Injected: true"` in the content-type parameter or header values to terminate the part header block early and inject arbitrary headers. Filenames and field names are properly escaped and not vulnerable. The injected headers remain within the multipart body and do not split the outer HTTP message; downstream multipart parsers determine the actual security impact. Patched versions (2.11.0+) validate and reject forbidden control characters (NUL, CR, LF, C0 controls except horizontal tab, and DEL) before serializing the request, raising `ValueError` on malicious input.

Affected products

  • Pydantic HTTPX2 < 2.11.0

Identifiers

  • CVE-2026-84379
  • GHSA-h4x7-gw46-3wm6
  • PYSEC-2026-3848

Timeline

  • 2026-08-18: disclosed: Initial security advisory published by Pydantic/HTTPX2
  • 2026-09-02: advisory: Published to National Vulnerability Database
  • 2026-09-08: advisory: Published to GitHub Advisory Database
  • 2026-09-08: patched: Fix released in HTTPX2 version 2.11.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.