Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iter_bytes() or aiter_bytes() yields bounded pieces to the application. A 64 KiB compressed chunk can expand to approximately 64 MiB in one intermediate allocation, so an attacker-controlled or compromised server can cause severe memory pressure or out-of-memory process termination even when the application streams the response. This issue is fixed in version 2.12.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-07 | 1 | Disclosure1 |
| 2026-09-09 | 1 | Patch1 |
CVE-2026-84382 https://github.com/pydantic/httpx2/security/advisories/GHSA-8xx6-hgc6-gc2m CVE番号ついた
Post summary
The post lists a CVE and provides a link to a GitHub advisory, but offers no additional technical, exploit, or patch information.
🚨High - HTTPX2 Streaming Decompression Memory Exhaustion (CVE-2026-84382) HTTPX2 <2.12.0 fully inflates each gzip/deflate/brotli/zstd network chunk into a single intermediate allocation before yielding streamed bytes. An attacker-controlled or compromised server can send small compressed chunks that expand to tens of MiB, causing memory pressure/OOM and process termination even with streaming enabled. 👉Affected: httpx2 < 2.12.0 | Upgrade to 2.12.0
Post summary
A CVE‑2026‑84382 memory exhaustion flaw in HTTPX2 allows attackers to trigger OOM by sending small compressed fragments; users should upgrade to version 2.12.0.