CVE-2026-84382 in httpx2
Summary
by MITRE • 09/02/2026
HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iter_bytes() or aiter_bytes() yields bounded pieces to the application. A 64 KiB compressed chunk can expand to approximately 64 MiB in one intermediate allocation, so an attacker-controlled or compromised server can cause severe memory pressure or out-of-memory process termination even when the application streams the response. This issue is fixed in version 2.12.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in HTTPX2 prior to version 2.12.0 represents a significant resource exhaustion flaw within the library's content decoding mechanisms, specifically affecting how compressed network chunks are processed before being yielded to the application layer. As a next-generation HTTP client for Python, HTTPX2 is designed to handle high-throughput and streaming scenarios efficiently. However, the implementation of its decoders in src/httpx2/httpx2/_decoders.py contained a critical architectural flaw where it fully inflated compressed data chunks such as gzip, deflate, brotli (br), or zstd into memory before passing bounded pieces to iter_bytes() or aiter_bytes(). This design choice contradicts the principle of streaming, which aims to process data in small increments to minimize peak memory usage. Consequently, even when an application utilizes these methods to stream responses and expects low memory overhead, the underlying decoder allocates space for the entire uncompressed chunk simultaneously.
The operational impact of this flaw is severe due to the high compression ratios achievable with modern algorithms like gzip or zstd. A relatively small compressed payload, such as a 64 KiB network chunk, can expand into approximately 64 MiB of uncompressed data in a single intermediate allocation. This exponential expansion means that an attacker controlling or compromising a server can trigger this behavior by sending highly compressible but large payloads disguised as small chunks. The resulting memory pressure can lead to out-of-memory conditions, causing the Python process to terminate abruptly. In distributed systems or services handling multiple concurrent requests, this vulnerability can be exploited for Denial of Service attacks, effectively rendering the service unavailable without requiring complex exploitation techniques beyond sending specific malformed responses.
From a classification perspective, this issue aligns with CWE-400, which describes Uncontrolled Resource Consumption, as the application fails to limit the amount of resources consumed during input processing. It also relates to CWE-789, Memory Allocation with Excessive Size Value, because the allocation size is determined by user-controllable data without adequate bounds checking relative to available system memory. In terms of attack vectors and tactics, this vulnerability facilitates resource exhaustion attacks that can be categorized under MITRE ATT&CK technique T1496, Resource Hijacking, specifically within the context of Denial of Service where an attacker consumes computational resources such as memory or CPU cycles to degrade service availability. The lack of streaming support for decompression means the client cannot mitigate these effects by processing data in smaller, manageable blocks.
To mitigate this vulnerability, organizations must ensure that all instances of HTTPX2 are upgraded to version 2.12.0 or later, where the decoding logic has been revised to avoid full inflation before yielding results. For environments unable to upgrade immediately, implementing a reverse proxy with strict response size limits can provide an additional layer of defense by truncating excessively large responses before they reach the Python application. Additionally, developers should monitor memory usage metrics in production environments to detect anomalies indicative of such resource exhaustion attacks. It is also advisable to review any custom decoders or wrappers around HTTPX2 to ensure they do not reintroduce similar non-streaming behaviors for compressed content types.