CVE-2026-84379 in HTTPX2
Summary
by MITRE • 09/02/2026
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attacker-controlled content_type values and custom headers from the files= three-element (filename, content, content_type) tuple and the files= four-element (filename, content, content_type, headers) tuple into multipart/form-data part headers without validating header names or values. CR or LF characters can terminate a part header, inject additional part headers, or end the part header block early, allowing a downstream multipart parser to treat attacker-supplied lines as genuine headers and potentially alter part semantics or bypass header-based checks. This issue is fixed in version 2.11.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in HTTPX2 versions prior to 2.11.0 represents a critical input validation failure within the multipart form data generation logic, specifically located in the FileField.render_headers method of the httpx2/_multipart module. As a next-generation HTTP client for Python, HTTPX2 is frequently utilized by developers to construct complex requests involving file uploads and structured data submission. The core technical flaw arises from the direct interpolation of user-supplied content_type values and custom headers into multipart/form-data part headers without performing adequate sanitization or validation checks on header names and values. This design oversight allows an attacker who controls the input parameters for the files argument to inject malicious characters directly into the HTTP request structure.
The specific mechanism of exploitation involves the injection of Carriage Return (CR) and Line Feed (LF) control characters, commonly known as CRLF sequences, into the filename, content_type, or custom headers fields provided in the three-element tuple (filename, content, content_type) or the four-element tuple including additional headers. In standard HTTP multipart parsing, these line breaks serve as delimiters that separate different parts of a message and define the boundaries between header names, values, and body content. By injecting CRLF sequences, an attacker can prematurely terminate existing part headers, inject entirely new fake headers into the request stream, or close the entire block of part headers earlier than intended by the application logic. This manipulation effectively alters the structure of the HTTP multipart message in a way that is syntactically valid but semantically deceptive to downstream parsers and servers.
The operational impact of this vulnerability is significant because it enables an attacker to manipulate how the receiving server interprets the request data. When the part header block ends early due to injected line breaks, subsequent lines intended as body content may be interpreted by a compliant multipart parser as genuine HTTP headers. This can lead to several adverse outcomes depending on the context of the application. For instance, it could allow an attacker to bypass security controls that rely on specific header values for authentication or authorization checks. It might also facilitate server-side request forgery scenarios where additional headers are injected to mislead internal services about the origin or nature of the request. Furthermore, if the downstream parser is vulnerable to HTTP response splitting or other CRLF-based injection attacks, this vulnerability could serve as a vector for more severe compromises such as cross-site scripting (XSS) via stored data in header fields that get reflected back to users.
This flaw aligns with CWE-74 Improper Neutralization of Special Elements used in an Output Document Called HTML Section 10 and is closely related to CWE-93 Improper Neutralization of CRLF Sequences, which falls under the broader category of Injection vulnerabilities (CWE-79). In terms of offensive security frameworks, this vulnerability maps to MITRE ATT&CK technique T1556.004 Modifying Authentication Process Headers, as it allows for the manipulation of HTTP headers that may influence authentication or authorization logic. It also touches upon T1132 Data Encoding, specifically non-standard encoding used in network communications, by exploiting how different parsers interpret raw byte sequences within header fields. The ability to alter part semantics means that data intended for one purpose can be reinterpreted as control information, undermining the integrity of the communication channel between the client and server.
To mitigate this vulnerability, organizations using HTTPX2 must immediately upgrade to version 2.11.0 or later, where the developers have implemented proper validation mechanisms to sanitize header names and values before they are interpolated into the multipart structure. For applications that cannot yet upgrade, a temporary workaround involves implementing strict input filtering on any data passed to the files parameter of HTTPX requests. This includes stripping or encoding all CR (ASCII 13) and LF (ASCII 10) characters from filenames, content types, and custom headers before they are processed by the library. Additionally, developers should adopt a defense-in-depth strategy by validating multipart payloads at the application layer using robust parsing libraries that enforce strict adherence to RFC standards for HTTP message formatting. Regular security audits of code handling file uploads and form data submissions are essential to identify similar patterns of improper input validation in other parts of the codebase.