CVE-2026-84378

Quadratic CPU consumption via crafted SSE lines causing DoS.

• CVSS 5.9
• 407
• Resource Management
• Remote

HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.py repeatedly copies and rescans buffered text in _SSELineDecoder.decode() when an attacker-controlled or compromised SSE endpoint splits one unterminated line across many response chunks. The behavior affects httpx2.Client.sse() and httpx2.AsyncClient.sse(), and the total processing work grows quadratically with the line length, allowing a crafted stream to consume excessive CPU and block a synchronous worker or asynchronous event loop. This issue is fixed in version 2.10.0.

CVE

CVE-2026-84378

CWE

407

CVSS base score

5.9

Published

2026-09-02

OWASP

A04 Insecure Design

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

HTTPX2

Fixed by upgrading

Yes

Solution

Upgrade httpx2 to version 2.10.0 or later.

import httpx2

class _SSELineDecoder:
    def __init__(self):
        self._buffer = ""

    def decode(self, chunk: str):
        # VULNERABLE: quadratic copying of buffered text per chunk
        self._buffer += chunk
        lines = []
        while True:
            # each iteration rescans the entire buffer
            newline_idx = self._buffer.find("\n")
            if newline_idx == -1:
                break
            line = self._buffer[:newline_idx]
            lines.append(line)
            # rescan the whole remaining buffer on next iteration
            self._buffer = self._buffer[newline_idx + 1 :]
        return lines

def process_sse(url: str):
    client = httpx2.Client()
    for chunk in client.sse(url):
        decoder = _SSELineDecoder()
        for line in decoder.decode(chunk):
            handle_event(line)

def handle_event(line: str):
    # placeholder for event handling logic
    pass

import httpx2

class _SSELineDecoder:
    def __init__(self):
        self._buffer = ""

    def decode(self, chunk: str):
        # FIX: avoid rescanning whole buffer; process only new data
        self._buffer += chunk
        lines = []
        start = 0
        while True:
            newline_idx = self._buffer.find("\n", start)
            if newline_idx == -1:
                # keep incomplete line for next chunk
                self._buffer = self._buffer[start:]
                break
            line = self._buffer[start:newline_idx]
            lines.append(line)
            start = newline_idx + 1
        return lines

def process_sse(url: str):
    client = httpx2.Client()
    decoder = _SSELineDecoder()
    for chunk in client.sse(url):
        for line in decoder.decode(chunk):
            handle_event(line)

def handle_event(line: str):
    # placeholder for event handling logic
    pass

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202684378,
  title        = {{Quadratic CPU consumption via crafted SSE lines causing DoS.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-84378},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-84378/}}
}