CVE-2026-84382: HTTPX2 Python Library DOS Vulnerability

CVE-2026-84382 Overview

CVE-2026-84382 is a resource consumption vulnerability [CWE-409] in HTTPX2, a next-generation HTTP client for Python maintained by Pydantic. The flaw resides in the content decoders defined in src/httpx2/httpx2/_decoders.py. HTTPX2 versions prior to 2.12.0 fully inflate each gzip, deflate, br, or zstd network chunk in a single allocation before iter_bytes() or aiter_bytes() yields bounded data to the caller. A 64 KiB compressed chunk can expand to approximately 64 MiB during intermediate decoding. An attacker-controlled or compromised server can trigger memory pressure or out-of-memory process termination, even when the application uses streaming APIs.

Critical Impact
A malicious HTTP response can force Python applications using HTTPX2 to allocate hundreds of megabytes per chunk, resulting in denial of service via memory exhaustion.

Affected Products

HTTPX2 for Python versions prior to 2.12.0
Applications and services that consume streamed HTTP responses through HTTPX2
Automated crawlers, API clients, and proxies that trust remote server responses using HTTPX2

Discovery Timeline

2026-09-02 - CVE-2026-84382 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84382

Vulnerability Analysis

HTTPX2 supports transparent decompression of common HTTP content encodings, including gzip, deflate, br (Brotli), and zstd (Zstandard). The decoders located in src/httpx2/httpx2/_decoders.py process each network chunk by invoking the underlying decompression library and returning the full inflated buffer. Streaming callers using iter_bytes() or aiter_bytes() receive bounded pieces, but only after the entire per-chunk allocation completes in memory.

Compression ratios for repeated bytes commonly reach 1000:1. A single 64 KiB chunk of adversarial input can therefore produce roughly 64 MiB of decoded output in one allocation. Repeated chunks compound the pressure, exhausting available memory on the client host.

Root Cause

The root cause is missing bounded decompression. The decoder does not enforce an output size ceiling per chunk, nor does it stream decompressed bytes incrementally through a fixed-size buffer. This maps directly to [CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)].

Attack Vector

Exploitation requires an attacker to control or influence an HTTP endpoint contacted by a client that uses HTTPX2. The attacker returns a response with a Content-Encoding header of gzip, deflate, br, or zstd, along with a highly compressed body. Applications that fetch attacker-influenced URLs, follow redirects to untrusted hosts, or process feeds from third parties are exposed.

python

# Patch excerpt from src/httpx2/httpx2/_client.py — incremental decoding of response bodies (#1126)
    async def __aiter__(self) -> typing.AsyncIterator[bytes]:
-        async for chunk in self._stream:
-            yield chunk
+        stream = self._stream.__aiter__()
+        try:
+            async for chunk in stream:
+                yield chunk
+        finally:
+            if isinstance(stream, AsyncGenerator):
+                await stream.aclose()

Source: GitHub Commit 4fd0c70

Detection Methods for CVE-2026-84382

Indicators of Compromise

Python processes using HTTPX2 that experience sudden RSS growth followed by MemoryError exceptions or OOM-killer terminations.
HTTP responses carrying Content-Encoding: gzip, deflate, br, or zstd with unusually high decompression ratios.
Repeated short-lived crashes of long-running Python services after outbound HTTP calls to untrusted hosts.

Detection Strategies

Inventory Python dependencies and flag any application pinning httpx2 < 2.12.0 in requirements.txt, pyproject.toml, or lockfiles.
Instrument HTTP client wrappers to log the ratio of Content-Length to decoded payload size and alert on ratios above a defined threshold.
Correlate application OOM events with recent outbound HTTP activity to identify decompression-driven exhaustion.

Monitoring Recommendations

Track memory metrics (RSS, heap allocations) for services that use HTTPX2 and alert on rapid growth during response handling.
Log outbound destinations and content-encoding headers at the egress proxy layer for retrospective analysis.
Enable process crash telemetry so restarts caused by kernel OOM decisions are surfaced to SOC dashboards.

How to Mitigate CVE-2026-84382

Immediate Actions Required

Upgrade HTTPX2 to version 2.12.0 or later in every affected service and rebuild container images.
Audit application code paths that call iter_bytes() or aiter_bytes() on responses from untrusted origins and add explicit size limits.
Restrict outbound HTTP destinations for services that do not require arbitrary internet access.

Patch Information

The fix ships in HTTPX2 2.12.0. Pull request #1126 modifies _decoders.py, _content.py, and _client.py to decode compressed bodies incrementally and close streams cleanly. Review the GitHub Release v2.12.0 notes and the GHSA-8xx6-hgc6-gc2m advisory before deploying.

Workarounds

Set an application-level cap on total response bytes read and abort transfers that exceed it.
Disable automatic decompression by removing Accept-Encoding headers when contacting untrusted endpoints.
Route outbound HTTP traffic through a proxy that validates decompressed payload size against a configured maximum.

bash

# Pin the fixed HTTPX2 release
pip install --upgrade 'httpx2>=2.12.0'

# Verify the installed version
python -c "import httpx2, sys; sys.exit(0 if httpx2.__version__ >= '2.12.0' else 1)"