CVE-2026-84382 HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
An attacker can cause out-of-memory termination in applications using HTTPX2 by sending compressed chunks that expand excessively during streaming.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84382?
CVE-2026-84382 is a high-severity denial of service vulnerability in pydantic httpx2, published on 2 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iter_bytes() or aiter_bytes() yields bounded pieces to the application. A 64 KiB compressed chunk can expand to approximately 64 MiB in one intermediate allocation, so an attacker-controlled or compromised server can cause severe memory pressure or out-of-memory process termination even when the application streams the response. This issue is fixed in version 2.12.0.
Weakness: CWE-409
Which versions are affected by CVE-2026-84382?
3 open source packages ship an affected version, including httpx2.
| Package | Affected | Fixed in |
|---|---|---|
httpx2 PyPI | All versions | 2.12.0 |
httpx2 PyPI | All versions | 2.12.0 |
httpx2 PyPI | All versions | 2.12.0 |
How do I fix CVE-2026-84382?
Upgrade httpx2 to 2.12.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-84382 being exploited?
There is no known exploitation of CVE-2026-84382 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-84382, ECHO-874b-ad07-3e0f, GHSA-8xx6-hgc6-gc2m, MINI-3r7q-5vj5-j568, MINI-xh52-9x6m-5mpg, PYSEC-2026-3846 and 2 more.