CVE-2021-41945 Improper Input Validation in httpx
Improper input validation in httpx URL handling allows potential security issues, requiring users to upgrade the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41945?
CVE-2021-41945 is a critical vulnerability in n/a, published on 28 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.
Weakness: CWE-20
Which versions are affected by CVE-2021-41945?
3 open source packages ship an affected version, including httpx. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
httpx PyPI | All versions | 0.20.0 |
httpx PyPI | All versions | 0.23.0 |
httpx PyPI | All versions | 0.23.0 |
Linux distribution packages (1)
python-httpx openSUSE:Tumbleweed | All versions | 0.28.1-2.1 |
Products include Encode Httpx.
How do I fix CVE-2021-41945?
Upgrade httpx to a fixed version for your release line: 0.20.0 or 0.23.0.
Is CVE-2021-41945 being exploited?
There is no known exploitation of CVE-2021-41945 in the wild and no public exploit code.
Sources
Also known as CLSA-2025-1752797525, DEBIAN-CVE-2021-41945, GHSA-h8pj-cxx2-jfg2, PYSEC-2022-183, UBUNTU-CVE-2021-41945, openSUSE-SU-2024:12041-1 and 1 more.