CVE-2026-84378

[CVE catalog]

Severity

Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

Sep 2, 2026, 5:54:19 PM UTC

Updated

Sep 2, 2026, 6:21:29 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.32% · Oct 27, 2026

A flaw was found in httpx2, a Python HTTP client. The Server-Sent Events (SSE) parser in httpx2 can be exploited by a remote attacker. By sending a specially crafted stream where an unterminated line is split across many response chunks, the parser repeatedly copies and rescans buffered text. This quadratic processing work consumes excessive CPU resources, leading to a Denial of Service (DoS) by blocking synchronous workers or asynchronous event loops. httpx2: HTTPX2: Denial of Service via crafted Server-Sent Events stream Moderate: A denial of service vulnerability exists in the HTTPX2 Python client library, affecting Red Hat products such as Lightspeed Core and Red Hat OpenShift AI. This flaw allows a remote attacker to consume excessive CPU resources by sending a specially crafted Server-Sent Events (SSE) stream, leading to resource exhaustion. The impact is limited to availability and requires interaction with a malicious or compromised SSE endpoint. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.