CVE-2026-84380: Pydantic HTTPX2 HTTP request smuggling via conflicting headers

CVE-2026-84380 · Severity: medium · CVSS 5.6 · Published 2026-09-02

HTTPX2 is a popular Python HTTP client library used by applications to make web requests. The library has a flaw where it can simultaneously include both Content-Length and Transfer-Encoding headers in a single HTTP request, violating HTTP standards. If an attacker-controlled application passes malformed request headers to HTTPX2 and the requests travel through proxies or intermediaries that handle these conflicting headers inconsistently, the attacker could manipulate how requests are processed—potentially bypassing security checks, hijacking sessions, or poisoning cached responses on shared connections.

Technologies: httpx2 (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-84380 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84380 being exploited in the wild.
How severe is CVE-2026-84380?
Medium severity, with a CVSS score of 5.6, published 2 September 2026.
Which products and versions are affected?
Encode HTTPX < 2.11.0; httpx2 (PyPI) < 2.11.0, ECOSYSTEM:introduced=0,fixed=2.11.0.
Is there a fix for CVE-2026-84380?
Yes. httpx2 (PyPI): upgrade to 2.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84380 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-84380?
Check whether you run Encode HTTPX or httpx2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • httpx2 (PyPI): upgrade to 2.11.0 or later
    pip install "httpx2>=2.11.0"

Technical details

The vulnerability is an HTTP request smuggling issue (CWE-444) in the request preparation logic. When a request body has a known size, HTTPX2's content encoder automatically returns a default Content-Length header. The Request._prepare() method applies default headers using setdefault(), which only checks if that specific header is already present—it does not check for the mutually exclusive Transfer-Encoding header. This allows both headers to coexist in the final HTTP/1.1 message. Exploitation requires: (1) an application passing attacker-controlled request framing headers to HTTPX2, (2) HTTP/1.1 connections, and (3) communication through a proxy or intermediary that accepts and interprets the conflicting headers differently from downstream hops. The attack can affect fixed-size bodies (bytes, JSON, form data, multipart), but not streaming bodies with explicit Content-Length. The fix, released in version 2.11.0, treats Content-Length and Transfer-Encoding as mutually exclusive when applying auto-generated headers.

Affected products

  • Pydantic HTTPX2 < 2.11.0

Identifiers

  • CVE-2026-84380
  • GHSA-pf96-p4fj-6566
  • PYSEC-2026-3849

Timeline

  • 2026-08-18: disclosed: Vulnerability published by Kludex
  • 2026-08-18: patched: Fix merged in PR #1137
  • 2026-08-18: other: HTTPX2 version 2.11.0 released with patch
  • 2026-09-08: advisory: GitHub Advisory Database published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.