CVE-2026-84378

HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.py repeatedly copies and rescans buffered text in _SSELineDecoder.decode() when an attacker-controlled or compromised SSE endpoint splits one unterminated line across many response chunks. The behavior affects httpx2.Client.sse() and httpx2.AsyncClient.sse(), and the total processing work grows quadratically with the line length, allowing a crafted stream to consume excessive CPU and block a synchronous worker or asynchronous event loop. This issue is fixed in version 2.10.0.

• CWE-407

• https://github.com/pydantic/httpx2/commit/cbfc0e04ef6507da29ccbb3b9c2e5b23dd693414
• https://github.com/pydantic/httpx2/pull/1071
• https://github.com/pydantic/httpx2/pull/1117
• https://github.com/pydantic/httpx2/releases/tag/v2.10.0
• https://github.com/pydantic/httpx2/security/advisories/GHSA-f2fp-rgf2-35cp

Published

Sep 2, 2026

Last Modified

Sep 9, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84372Predis is a flexible and feature-complete Redis and Valkey c…9.8
• CVE-2026-84373Vitest is a testing framework powered by Vite. From 2.1.0 un…5.9
• CVE-2026-84374Laravel Excel provides supercharged Excel exports and import…7.5
• CVE-2026-84375js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 u…7.5
• CVE-2026-84376Astro is a web framework for content-driven websites. Prior …6.3
• CVE-2026-84377LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…6.5
• CVE-2026-84379HTTPX2 is a next generation HTTP client for Python. Prior to…5.3
• CVE-2026-8438The All-In-One Security (AIOS) – Security and Firewall plugi…7.2
• CVE-2026-84380HTTPX2 is a next generation HTTP client for Python. Prior to…5.6
• CVE-2026-84381HTTPX2 is a next generation HTTP client for Python. Prior to…8.1
• CVE-2026-84382HTTPX2 is a next generation HTTP client for Python. Prior to…7.5
• CVE-2026-84383libheif is a HEIF and AVIF file format decoder and encoder. …9.8