CVE-2026-84379 HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
Attacker can inject headers into multipart requests via unvalidated file content types, potentially bypassing security checks or altering request semantics.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84379?
CVE-2026-84379 is a medium-severity vulnerability in pydantic httpx2, published on 2 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attacker-controlled content_type values and custom headers from the files= three-element (filename, content, content_type) tuple and the files= four-element (filename, content, content_type, headers) tuple into multipart/form-data part headers without validating header names or values. CR or LF characters can terminate a part header, inject additional part headers, or end the part header block early, allowing a downstream multipart parser to treat attacker-supplied lines as genuine headers and potentially alter part semantics or bypass header-based checks. This issue is fixed in version 2.11.0.
Weakness: CWE-93
Which versions are affected by CVE-2026-84379?
3 open source packages ship an affected version, including httpx2.
| Package | Affected | Fixed in |
|---|---|---|
httpx2 PyPI | All versions | 2.11.0 |
httpx2 PyPI | All versions | 2.11.0 |
httpx2 PyPI | All versions | 2.11.0 |
How do I fix CVE-2026-84379?
Upgrade httpx2 to 2.11.0 or later.
Is CVE-2026-84379 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-84379 exists.
Sources
Also known as DEBIAN-CVE-2026-84379, ECHO-247e-4779-126f, GHSA-h4x7-gw46-3wm6, MINI-2hjp-jp9r-83vp, MINI-42hc-87g8-j8hq, PYSEC-2026-3848 and 1 more.