CVE-2026-84380

[CVE catalog]

Severity

Medium · CVSS 5.6CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Published

Sep 2, 2026, 5:58:55 PM UTC

Updated

Sep 2, 2026, 6:21:29 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.22% · Oct 25, 2026

A flaw was found in HTTPX2, a Python HTTP client. The `Request._prepare()` function can incorrectly add a `Content-Length` header to a request that already includes a `Transfer-Encoding` header. This conflict in HTTP framing headers can lead to request smuggling or connection desynchronization. This could allow an attacker to bypass security controls or interfere with network traffic. httpx2: HTTPX2: Request Smuggling and Connection Desynchronization via Conflicting HTTP Headers This vulnerability is rated Moderate. The HTTPX2 Python client can be exploited for request smuggling or connection desynchronization due to conflicting HTTP framing headers. Exploitation requires a high attack complexity, as it depends on how downstream intermediaries process these conflicting headers, leading to limited impact on confidentiality, integrity, and availability. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.