Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

httpx2

5 known vulnerabilities (2 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 2 high, 3 medium
Weekly downloads
95.3M
Dependents
61.6K
Registry
PyPI

Advisories 5

  • HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

    Affected: fixed in 2.12.0.

  • HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies

    Affected: from 2.6.0, fixed in 2.10.0.

  • CVE-2026-84380Medium 5.6

    HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

    Affected: fixed in 2.11.0.

  • CVE-2026-84379Medium 5.3

    HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

    Affected: fixed in 2.11.0.

  • CVE-2026-84378Medium 5.9

    HTTPX2: Quadratic SSE line buffering can cause CPU denial of service

    Affected: from 2.5.0, fixed in 2.10.0.