CVE-2026-84378 in Httpx2
Summary
by MITRE • 09/02/2026
HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.py repeatedly copies and rescans buffered text in _SSELineDecoder.decode() when an attacker-controlled or compromised SSE endpoint splits one unterminated line across many response chunks. The behavior affects httpx2.Client.sse() and httpx2.AsyncClient.sse(), and the total processing work grows quadratically with the line length, allowing a crafted stream to consume excessive CPU and block a synchronous worker or asynchronous event loop. This issue is fixed in version 2.10.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified as CVE-2024-35879 affects HTTPX2, a high-performance HTTP client library for Python that supports modern web protocols including Server-Sent Events (SSE). The core of the issue resides within the SSE parser implementation located in the source file src/httpx2/httpx2/_sse.py. Specifically, the _SSELineDecoder.decode() method exhibits inefficient memory and processing behavior when handling fragmented data streams. This flaw is present in versions ranging from 2.5.0 up to but not including 2.10.0. The vulnerability manifests when an attacker-controlled or compromised SSE endpoint deliberately splits a single logical line of text across multiple HTTP response chunks. Under normal circumstances, the parser processes incoming data efficiently; however, this specific scenario triggers a pathological behavior where the decoder repeatedly copies and rescans buffered text rather than processing it incrementally with constant time complexity relative to input size.
From a technical perspective, the root cause is an algorithmic inefficiency in how the SSE line decoder handles unterminated lines that span multiple network packets or chunks. Instead of maintaining a persistent buffer state that allows for linear scanning, the implementation re-processes previously scanned data every time new bytes arrive. This results in quadratic time complexity relative to the length of the incomplete line. As the attacker sends more chunks containing parts of this long, unterminated line, the computational effort required by the client increases exponentially rather than linearly. This design flaw directly impacts both httpx2.Client.sse() for synchronous operations and httpx2.AsyncClient.sse() for asynchronous event loops, meaning any application relying on these methods to consume SSE streams is susceptible to this resource exhaustion attack vector.
The operational impact of this vulnerability is significant, primarily centering on Denial of Service through CPU consumption. Because the processing work grows quadratically with line length, a crafted stream can rapidly exhaust available CPU resources on the host system. In synchronous environments using httpx2.Client.sse(), this excessive computation blocks the worker thread entirely, preventing it from handling other requests and effectively causing a service outage for that specific user or process. Similarly, in asynchronous contexts utilizing httpx2.AsyncClient.sse(), the event loop becomes blocked by the intensive computational load. This prevents the execution of coroutines and delays response to other clients, degrading overall application performance and potentially leading to complete unavailability if multiple such connections are established simultaneously.
This vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as the flaw allows an external actor to trigger excessive resource usage without proper limits or safeguards. It also relates to CWE-756: Missing Dynamic Resource Management Hooks, in that the parser fails to manage its internal buffer and processing state efficiently under adversarial conditions. From a threat intelligence perspective, this behavior is consistent with techniques found in MITRE ATT&CK T1496: Resource Hijacking, where attackers leverage compromised or malicious inputs to consume system resources for disruptive purposes rather than data exfiltration. The attack does not require authentication and can be executed remotely by any client interacting with a vulnerable SSE endpoint that has been manipulated to send fragmented, long lines.
Mitigation strategies focus primarily on upgrading the library version. Users running HTTPX2 versions 2.5.0 through 2.9.x should immediately upgrade to version 2.10.0 or later, where this quadratic complexity issue in _SSELineDecoder.decode() has been resolved. For applications that cannot be updated instantly due to dependency constraints, implementing rate limiting on SSE connections can help mitigate the impact by restricting the number of concurrent streams a single client may establish. Additionally, setting timeouts for SSE connection establishment and data reception can prevent long-running processes from consuming resources indefinitely while waiting for complete lines that may never arrive in a timely manner. Application-level monitoring should also be configured to detect abnormal CPU spikes associated with HTTPX2 worker threads or event loops, allowing for rapid identification and isolation of affected instances during an active attack.