CVE-2026-84382
2 advisories.
PyPI/httpx2 CVE-2026-84382: high 7.5
HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
Action: Upgrade httpx2 to 2.12.0 or later.
pip install httpx2==2.12.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.12.0 | - |
Fixed versions
| 2.12.0 |
Sources
- osv: GHSA-8xx6-hgc6-gc2m
- https://github.com/pydantic/httpx2/security/advisories/GHSA-8xx6-hgc6-gc2m
- https://nvd.nist.gov/vuln/detail/CVE-2026-84382
- https://github.com/pydantic/httpx2/pull/1126
- https://github.com/pydantic/httpx2/commit/4fd0c70a3f207c618b145934792f791bccfb39f8
- https://github.com/pydantic/httpx2
- https://github.com/pydantic/httpx2/releases/tag/v2.12.0
CVE-2026-84382 · published · modified · JSON
PyPI/httpx2 CVE-2026-84382: high 7.5
HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
Action: Upgrade httpx2 to 2.12.0 or later.
pip install httpx2==2.12.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.12.0 | - |
Fixed versions
| 2.12.0 |
Sources
- osv: PYSEC-2026-3846
- https://github.com/pydantic/httpx2/security/advisories/GHSA-8xx6-hgc6-gc2m
- https://nvd.nist.gov/vuln/detail/CVE-2026-84382
- https://github.com/pydantic/httpx2/pull/1126
- https://github.com/pydantic/httpx2/commit/4fd0c70a3f207c618b145934792f791bccfb39f8
- https://github.com/pydantic/httpx2
- https://github.com/pydantic/httpx2/releases/tag/v2.12.0
- https://pypi.org/project/httpx2
- https://github.com/advisories/GHSA-8xx6-hgc6-gc2m
CVE-2026-84382 · published · modified · JSON