{"answers":{"affected":"3 open source packages ship an affected version, including httpx2.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-84379 exists.","fix":"Upgrade httpx2 to 2.11.0 or later.","what":"CVE-2026-84379 is a medium-severity vulnerability in pydantic httpx2, published on 2 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-84379 and fix it if it is affected.\n\nWhat it is: CVE-2026-84379 is a medium-severity vulnerability in pydantic httpx2, published on 2 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-84379 exists.\n\nAffected packages and fixed versions:\n- httpx2 (PyPI): affected all versions; fixed in 2.11.0\n- httpx2 (PyPI): affected all versions; fixed in 2.11.0\n- httpx2 (PyPI): affected all versions; fixed in 2.11.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-84379/ (Markdown: https://insights.sbomify.com/CVE-2026-84379/index.md)","id":"CVE-2026-84379","markdown":"https://insights.sbomify.com/CVE-2026-84379/index.md","name":"CVE-2026-84379","record":{"aliases":["DEBIAN-CVE-2026-84379","ECHO-247e-4779-126f","GHSA-h4x7-gw46-3wm6","MINI-2hjp-jp9r-83vp","MINI-42hc-87g8-j8hq","PYSEC-2026-3848","UBUNTU-CVE-2026-84379"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["security_bypass","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Python HTTP client","requires_auth":"none","summary":"Attacker can inject headers into multipart requests via unvalidated file content types, potentially bypassing security checks or altering request semantics.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-93","name":"Improper Neutralization of CRLF Sequences"}],"description":"HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attacker-controlled content_type values and custom headers from the files= three-element (filename, content, content_type) tuple and the files= four-element (filename, content, content_type, headers) tuple into multipart/form-data part headers without validating header names or values. CR or LF characters can terminate a part header, inject additional part headers, or end the part header block early, allowing a downstream multipart parser to treat attacker-supplied lines as genuine headers and potentially alter part semantics or bypass header-based checks. This issue is fixed in version 2.11.0.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers","id":"CVE-2026-84379","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"other","year":"2026"},"n_packages":3,"n_references":4,"next":{"headline":"HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated","id":"CVE-2026-84380"},"packages":[{"ecosystem":"PyPI","fixed":["2.11.0"],"introduced":["0"],"last_affected":[],"package":"httpx2","purl":null,"source":"GHSA-h4x7-gw46-3wm6"},{"ecosystem":"PyPI","fixed":["2.11.0"],"introduced":["0"],"last_affected":[],"package":"httpx2","purl":"pkg:pypi/httpx2","source":"GHSA-h4x7-gw46-3wm6"},{"ecosystem":"PyPI","fixed":["2.11.0"],"introduced":["0"],"last_affected":[],"package":"httpx2","purl":"pkg:pypi/httpx2","source":"PYSEC-2026-3848"}],"prev":{"headline":"HTTPX2: Quadratic SSE line buffering can cause CPU denial of service","id":"CVE-2026-84378"},"products":["httpx2"],"published":"2026-09-02","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-02","vendors":["pydantic"]},"summary":"Attacker can inject headers into multipart requests via unvalidated file content types, potentially bypassing security checks or altering request semantics.","url":"https://insights.sbomify.com/CVE-2026-84379/"}