CVE-2026-84380: Pydantic HTTPX2 HTTP request smuggling via conflicting headers

CVE-2026-84380 · Severity: medium · CVSS 5.6 · Published 2026-09-08

Executive brief

HTTPX2 is a popular Python HTTP client library used by applications to make web requests. The library has a flaw where it can simultaneously include both Content-Length and Transfer-Encoding headers in a single HTTP request, violating HTTP standards. If an attacker-controlled application passes malformed request headers to HTTPX2 and the requests travel through proxies or intermediaries that handle these conflicting headers inconsistently, the attacker could manipulate how requests are processed—potentially bypassing security checks, hijacking sessions, or poisoning cached responses on shared connections.

Technical details

The vulnerability is an HTTP request smuggling issue (CWE-444) in the request preparation logic. When a request body has a known size, HTTPX2's content encoder automatically returns a default Content-Length header. The Request._prepare() method applies default headers using setdefault(), which only checks if that specific header is already present—it does not check for the mutually exclusive Transfer-Encoding header. This allows both headers to coexist in the final HTTP/1.1 message. Exploitation requires: (1) an application passing attacker-controlled request framing headers to HTTPX2, (2) HTTP/1.1 connections, and (3) communication through a proxy or intermediary that accepts and interprets the conflicting headers differently from downstream hops. The attack can affect fixed-size bodies (bytes, JSON, form data, multipart), but not streaming bodies with explicit Content-Length. The fix, released in version 2.11.0, treats Content-Length and Transfer-Encoding as mutually exclusive when applying auto-generated headers.

CVE-2026-84380: Pydantic HTTPX2 HTTP request smuggling via conflicting headers

Executive brief

Technical details

Affected products

Timeline

References

Related threats