CVE-2026-84382: Pydantic HTTPX2 decompression memory amplification

CVE-2026-84382 · Severity: high · CVSS 7.5 · Published 2026-09-02

HTTPX2 is a popular HTTP client library for Python. When fetching compressed responses from servers, the library fully decompresses network chunks before yielding data to the application, causing extremely large temporary memory allocations (up to 64 MiB from a 64 KiB compressed chunk). Attackers can send specially crafted compressed payloads to cause out-of-memory errors, disrupting web scrapers, webhook handlers, and other services that fetch data from untrusted sources.

Technologies: httpx2 (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-84382 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84382 being exploited in the wild.
How severe is CVE-2026-84382?
High severity, with a CVSS score of 7.5, published 2 September 2026.
Which products and versions are affected?
httpx2 (PyPI) < 2.12.0, ECOSYSTEM:introduced=0,fixed=2.12.0.
Is there a fix for CVE-2026-84382?
Yes. httpx2 (PyPI): upgrade to 2.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84382 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-84382?
Check whether you run httpx2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • httpx2 (PyPI): upgrade to 2.12.0 or later
    pip install "httpx2>=2.12.0"

Technical details

The vulnerability is a decompression amplification issue (CWE-409) in HTTPX2's response handling. Before version 2.12.0, the transport layer read up to 64 KiB chunks from the socket and fully decompressed each chunk into a single intermediate buffer before yielding any bytes to the application. Due to extreme compression ratios (DEFLATE can achieve ~1032:1, Brotli and Zstandard similarly), a 64 KiB compressed payload could expand to approximately 64 MiB in memory. Attack vector is network-based with no authentication or user interaction required beyond issuing a request. Applications vulnerable include webhook receivers, link unfurlers, crawlers, and redirect followers that process responses from attacker-influenced servers. The fix in version 2.12.0 implements incremental decompression with bounded intermediate buffers, including support for responses with multiple content encodings.

Affected products

  • Pydantic HTTPX2 < 2.12.0

Identifiers

  • CVE-2026-84382
  • GHSA-8xx6-hgc6-gc2m
  • PYSEC-2026-3846

Timeline

  • 2026-09-08: disclosed: GitHub Advisory published
  • 2026-09-02: advisory: NVD entry published
  • 2026-08-18: patched: Version 2.12.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.