CVE-2026-84382

HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iter_bytes() or aiter_bytes() yields bounded pieces to the application. A 64 KiB compressed chunk can expand to approximately 64 MiB in one intermediate allocation, so an attacker-controlled or compromised server can cause severe memory pressure or out-of-memory process termination even when the application streams the response. This issue is fixed in version 2.12.0.

• CWE-409

• https://github.com/pydantic/httpx2/commit/4fd0c70a3f207c618b145934792f791bccfb39f8
• https://github.com/pydantic/httpx2/pull/1126
• https://github.com/pydantic/httpx2/releases/tag/v2.12.0
• https://github.com/pydantic/httpx2/security/advisories/GHSA-8xx6-hgc6-gc2m

Published

Sep 2, 2026

Last Modified

Sep 9, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84377LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…6.5
• CVE-2026-84378HTTPX2 is a next generation HTTP client for Python. From 2.5…5.9
• CVE-2026-84379HTTPX2 is a next generation HTTP client for Python. Prior to…5.3
• CVE-2026-8438The All-In-One Security (AIOS) – Security and Firewall plugi…7.2
• CVE-2026-84380HTTPX2 is a next generation HTTP client for Python. Prior to…5.6
• CVE-2026-84381HTTPX2 is a next generation HTTP client for Python. Prior to…8.1
• CVE-2026-84383libheif is a HEIF and AVIF file format decoder and encoder. …9.8
• CVE-2026-84384libheif is a HEIF and AVIF file format decoder and encoder. …7.5
• CVE-2026-84385A improper access control vulnerability in Fortinet FortiSOA…5.4
• CVE-2026-84386A unverified ownership vulnerability in Fortinet FortiClient…5.1
• CVE-2026-84387A improper neutralization of special elements used in a comm…7.2
• CVE-2026-84389A url redirection to untrusted site ('open redirect') vulner…3.1