Executive brief
HTTPX2 is a popular HTTP client library for Python. When fetching compressed responses from servers, the library fully decompresses network chunks before yielding data to the application, causing extremely large temporary memory allocations (up to 64 MiB from a 64 KiB compressed chunk). Attackers can send specially crafted compressed payloads to cause out-of-memory errors, disrupting web scrapers, webhook handlers, and other services that fetch data from untrusted sources.
Technical details
The vulnerability is a decompression amplification issue (CWE-409) in HTTPX2's response handling. Before version 2.12.0, the transport layer read up to 64 KiB chunks from the socket and fully decompressed each chunk into a single intermediate buffer before yielding any bytes to the application. Due to extreme compression ratios (DEFLATE can achieve ~1032:1, Brotli and Zstandard similarly), a 64 KiB compressed payload could expand to approximately 64 MiB in memory. Attack vector is network-based with no authentication or user interaction required beyond issuing a request. Applications vulnerable include webhook receivers, link unfurlers, crawlers, and redirect followers that process responses from attacker-influenced servers. The fix in version 2.12.0 implements incremental decompression with bounded intermediate buffers, including support for responses with multiple content encodings.
Affected products
- Pydantic HTTPX2 < 2.12.0
Timeline
- 2026-09-08: disclosed: GitHub Advisory published
- 2026-09-02: advisory: NVD entry published
- 2026-08-18: patched: Version 2.12.0 released with fix