# CVE-2026-84382: Pydantic HTTPX2 decompression memory amplification

Source: https://junglewise.ai/threats/cve-2026-84382-pydantic-httpx2-decompression-memory-amplification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84382 · Severity: high · CVSS 7.5 · Published 2026-09-02

HTTPX2 is a popular HTTP client library for Python. When fetching compressed responses from servers, the library fully decompresses network chunks before yielding data to the application, causing extremely large temporary memory allocations (up to 64 MiB from a 64 KiB compressed chunk). Attackers can send specially crafted compressed payloads to cause out-of-memory errors, disrupting web scrapers, webhook handlers, and other services that fetch data from untrusted sources.

Technologies: [httpx2 (PyPI)](https://junglewise.ai/threats/technologies/httpx2). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-84382 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84382 being exploited in the wild.

**How severe is CVE-2026-84382?** High severity, with a CVSS score of 7.5, published 2 September 2026.

**Which products and versions are affected?** httpx2 (PyPI) < 2.12.0, ECOSYSTEM:introduced=0,fixed=2.12.0.

**Is there a fix for CVE-2026-84382?** Yes. httpx2 (PyPI): upgrade to 2.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84382 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-84382?** Check whether you run httpx2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- httpx2 (PyPI): upgrade to 2.12.0 or later

  ```sh
  pip install "httpx2>=2.12.0"
  ```


## Technical details

The vulnerability is a decompression amplification issue (CWE-409) in HTTPX2's response handling. Before version 2.12.0, the transport layer read up to 64 KiB chunks from the socket and fully decompressed each chunk into a single intermediate buffer before yielding any bytes to the application. Due to extreme compression ratios (DEFLATE can achieve ~1032:1, Brotli and Zstandard similarly), a 64 KiB compressed payload could expand to approximately 64 MiB in memory. Attack vector is network-based with no authentication or user interaction required beyond issuing a request. Applications vulnerable include webhook receivers, link unfurlers, crawlers, and redirect followers that process responses from attacker-influenced servers. The fix in version 2.12.0 implements incremental decompression with bounded intermediate buffers, including support for responses with multiple content encodings.

## Affected products

- Pydantic HTTPX2 < 2.12.0

## Identifiers

- CVE-2026-84382
- GHSA-8xx6-hgc6-gc2m
- PYSEC-2026-3846

## Timeline

- 2026-09-08: disclosed: GitHub Advisory published
- 2026-09-02: advisory: NVD entry published
- 2026-08-18: patched: Version 2.12.0 released with fix

## References

- [https://api.github.com/users/tawAsh1](https://api.github.com/users/tawAsh1)
- [https://github.com/tawAsh1](https://github.com/tawAsh1)
- [https://api.github.com/users/tawAsh1/gists%7B/gist_id%7D](https://api.github.com/users/tawAsh1/gists%7B/gist_id%7D)
- [https://api.github.com/users/tawAsh1/repos](https://api.github.com/users/tawAsh1/repos)
- [https://avatars.githubusercontent.com/u/7100187?v=4](https://avatars.githubusercontent.com/u/7100187?v=4)
- [https://api.github.com/users/tawAsh1/events%7B/privacy%7D](https://api.github.com/users/tawAsh1/events%7B/privacy%7D)

## Related threats

- [HTTPX2 secure WebSocket plaintext transmission via SOCKS proxy](https://junglewise.ai/threats/cve-2026-84381-httpx2-secure-websocket-plaintext-transmission-via-socks-proxy)
- [Pydantic HTTPX2 HTTP request smuggling via conflicting headers](https://junglewise.ai/threats/cve-2026-84380-pydantic-httpx2-http-request-smuggling-via-conflicting-headers)
- [HTTPX2 multipart header injection via unvalidated Content-Type and headers](https://junglewise.ai/threats/cve-2026-84379-httpx2-multipart-header-injection-via-unvalidated-content-type)
- [HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.](https://junglewise.ai/threats/cve-2026-84378-httpx2-quadratic-sse-line-buffering-denial-of-service)