httpx2 2.8.0

Direct Vulnerabilities

Known vulnerabilities in the httpx2 package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Inefficient Algorithmic Complexity httpx2 is a The next generation HTTP client. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the `sse`. An attacker can cause excessive CPU consumption by sending a long, unterminated line split across many small response chunks from a compromised or malicious SSE endpoint, resulting in quadratic processing time and potential denial of service. How to fix Inefficient Algorithmic Complexity? Upgrade `httpx2` to version 2.10.0 or higher.	[2.5.0,2.10.0)
H Data Amplification httpx2 is a The next generation HTTP client. Affected versions of this package are vulnerable to Data Amplification in the default transport's response decompression, which inflates each network read of up to 64 KiB completely into a single intermediate allocation before yielding any decompressed bytes, across the gzip, deflate, brotli, and zstandard encodings. An attacker can exhaust the client's memory and terminate the process by serving a compressed response at a ratio reaching 1032:1, so each chunk read expands to roughly 64 MiB in one allocation. This requires the application to fetch responses from a server the attacker controls or can influence, which puts webhook receivers, link unfurlers, crawlers, fetchers reachable through SSRF, and redirect followers in scope. How to fix Data Amplification? Upgrade `httpx2` to version 2.12.0 or higher.	[,2.12.0)
M HTTP Request Smuggling httpx2 is a The next generation HTTP client. Affected versions of this package are vulnerable to HTTP Request Smuggling in `Request._prepare()`, which applies a generated `Content-Length` header through `setdefault()` whenever the body size is known, without checking whether the caller has already supplied a `Transfer-Encoding` header, so both mutually exclusive framing headers can appear on one HTTP/1.1 request. An attacker can smuggle a request or desynchronize a persistent connection, reaching other requests sharing it, bypassing front end routing or authorization decisions, and poisoning responses or caches, by getting a `Transfer-Encoding` header and matching body data into a request the application constructs. This requires HTTP/1.1, an application that forwards attacker influenced framing headers into the request, and an intermediary or origin that accepts the conflicting pair rather than rejecting the message outright. How to fix HTTP Request Smuggling? Upgrade `httpx2` to version 2.11.0 or higher.	[,2.11.0)
M CRLF Injection httpx2 is a The next generation HTTP client. Affected versions of this package are vulnerable to CRLF Injection in the `FileField.render_headers()` method, which writes the per file `content_type` value and any custom header names and values into the multipart part header block without rejecting CR or LF characters. An attacker can inject additional part headers into the request or terminate the part header block early, altering how the receiving server interprets the part and bypassing checks it makes on part headers, by placing a CRLF sequence in upload metadata that the application passes through to the `files=` tuple. This requires the application to take the per file `content_type` or `headers` arguments from attacker influenced data rather than setting them itself, and the effect lands on whatever the upload is sent to, so the consequence depends on that server's own multipart parsing and validation. How to fix CRLF Injection? Upgrade `httpx2` to version 2.11.0 or higher.	[,2.11.0)

Vulnerability

Vulnerable Version

Inefficient Algorithmic Complexity

httpx2 is a The next generation HTTP client.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the sse. An attacker can cause excessive CPU consumption by sending a long, unterminated line split across many small response chunks from a compromised or malicious SSE endpoint, resulting in quadratic processing time and potential denial of service.

How to fix Inefficient Algorithmic Complexity?

Upgrade httpx2 to version 2.10.0 or higher.

[2.5.0,2.10.0)

Data Amplification

httpx2 is a The next generation HTTP client.

Affected versions of this package are vulnerable to Data Amplification in the default transport's response decompression, which inflates each network read of up to 64 KiB completely into a single intermediate allocation before yielding any decompressed bytes, across the gzip, deflate, brotli, and zstandard encodings. An attacker can exhaust the client's memory and terminate the process by serving a compressed response at a ratio reaching 1032:1, so each chunk read expands to roughly 64 MiB in one allocation. This requires the application to fetch responses from a server the attacker controls or can influence, which puts webhook receivers, link unfurlers, crawlers, fetchers reachable through SSRF, and redirect followers in scope.

How to fix Data Amplification?

Upgrade httpx2 to version 2.12.0 or higher.

[,2.12.0)

HTTP Request Smuggling

httpx2 is a The next generation HTTP client.

Affected versions of this package are vulnerable to HTTP Request Smuggling in Request._prepare(), which applies a generated Content-Length header through setdefault() whenever the body size is known, without checking whether the caller has already supplied a Transfer-Encoding header, so both mutually exclusive framing headers can appear on one HTTP/1.1 request. An attacker can smuggle a request or desynchronize a persistent connection, reaching other requests sharing it, bypassing front end routing or authorization decisions, and poisoning responses or caches, by getting a Transfer-Encoding header and matching body data into a request the application constructs. This requires HTTP/1.1, an application that forwards attacker influenced framing headers into the request, and an intermediary or origin that accepts the conflicting pair rather than rejecting the message outright.

How to fix HTTP Request Smuggling?

Upgrade httpx2 to version 2.11.0 or higher.

[,2.11.0)

CRLF Injection

httpx2 is a The next generation HTTP client.

Affected versions of this package are vulnerable to CRLF Injection in the FileField.render_headers() method, which writes the per file content_type value and any custom header names and values into the multipart part header block without rejecting CR or LF characters. An attacker can inject additional part headers into the request or terminate the part header block early, altering how the receiving server interprets the part and bypassing checks it makes on part headers, by placing a CRLF sequence in upload metadata that the application passes through to the files= tuple. This requires the application to take the per file content_type or headers arguments from attacker influenced data rather than setting them itself, and the effect lands on whatever the upload is sent to, so the consequence depends on that server's own multipart parsing and validation.

How to fix CRLF Injection?

Upgrade httpx2 to version 2.11.0 or higher.

[,2.11.0)

httpx2@2.8.0

The next generation HTTP client.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically