PyPI/httpx CVE-2021-41945: critical 9.1, EPSS 2.12%

Improper Input Validation in httpx

Action: Upgrade httpx to 0.23.0 or later.

pip install httpx==0.23.0

Affected

Fixed versions

Sources

• osv: GHSA-h8pj-cxx2-jfg2
• https://nvd.nist.gov/vuln/detail/CVE-2021-41945
• https://github.com/encode/httpx/issues/2184
• https://github.com/encode/httpx/pull/2185
• https://github.com/encode/httpx/pull/2185/commits/e3c495a32c63d8aa7f1bcf3b7b27ee1a0ff428e1
• https://github.com/encode/httpx/commit/e9b0c85dd4f4e4469c57c4b38e5101fd12081b5c
• https://gist.github.com/lebr0nli/4edb76bbd3b5ff993cf44f2fbce5e571
• https://github.com/advisories/GHSA-h8pj-cxx2-jfg2
• https://github.com/encode/httpx
• https://github.com/encode/httpx/discussions/1831
• https://github.com/encode/httpx/releases/tag/0.23.0
• https://github.com/pypa/advisory-database/tree/main/vulns/httpx/PYSEC-2022-183.yaml
• http://encode.com

CVE-2021-41945 · published 2022-04-29T00:00:25Z · modified 2025-02-13T05:30:38.616835Z · JSON