CVE catalog

CVE-2026-84379

HTTPX2 is a next generation HTTP client for Python…

[CVE catalog]

A flaw was found in HTTPX2, a Python HTTP client. A remote attacker could exploit this vulnerability by sending specially crafted multipart/form-data requests. The `FileField.render_headers()` function fails to validate `Content-Type` values and custom headers, allowing the injection of Carriage Return (CR) or Line Feed (LF) characters. This could lead to the injection of arbitrary part headers, potentially altering the interpretation of multipart data or bypassing security checks by a downstream parser. httpx2: HTTPX2: Multipart header injection via unvalidated input This Moderate severity flaw in the `httpx2` Python library allows for multipart header injection. An attacker could exploit this by providing specially crafted `content_type` values or custom headers when an application uses `httpx2` to send multipart form data, potentially leading to altered part semantics or bypassing header-based security checks. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.32% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debian14python-httpx22.12.0-1UnknownSource applicability is not established[DEBIAN-CVE-2026-84379]
Debian14python-httpx22.4.0-1UnknownSource applicability is not established[DEBIAN-CVE-2026-84379]
Debian14python-httpx22.5.0-1UnknownSource applicability is not established[DEBIAN-CVE-2026-84379]
PyPIRelease not reportedhttpx22.11.0UnknownSource applicability is not established[PYSEC-2026-3848]GHSA-H4X7-GW46-3WM6
Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
PyPIRelease not reportedhttpx22.11.0UnknownSource applicability is not established[PYSEC-2026-3848]GHSA-H4X7-GW46-3WM6
Debian14python-httpx22.12.0-1UnknownSource applicability is not established[DEBIAN-CVE-2026-84379]
Debian14python-httpx22.4.0-1UnknownSource applicability is not established[DEBIAN-CVE-2026-84379]
Debian14python-httpx22.5.0-1UnknownSource applicability is not established[DEBIAN-CVE-2026-84379]
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "httpx2",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.0"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "provider_url": "https://osv.dev/vulnerability/PYSEC-2026-3848",
      "fixed_version": "2.11.0",
      "provider_source": "pypi",
      "provider_record_id": "PYSEC-2026-3848",
      "provider_updated_at": "2026-09-10T12:15:04.992530880Z",
      "applicability_unknown": true
    },
    {
      "name": "httpx2",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.0"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "fixed_version": "2.11.0",
      "provider_record_id": "GHSA-H4X7-GW46-3WM6",
      "applicability_unknown": true
    },
    {
      "name": "python-httpx2",
      "distro": "debian",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.12.0-1"
            }
          ]
        }
      ],
      "release": "14",
      "versions": [
        "2.4.0-1",
        "2.5.0-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-84379",
      "fixed_version": "2.12.0-1",
      "provider_source": "pypi",
      "provider_record_id": "DEBIAN-CVE-2026-84379",
      "provider_updated_at": "2026-10-01T03:03:51.123727682Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

Observed:

References

[FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]