CVE-2026-84379

HTTPX2 multipart header injection via unvalidated content_type and custom headers.

• CVSS 5.3
• 93
• Input Validation and Sanitization
• Remote

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attacker-controlled content_type values and custom headers from the files= three-element (filename, content, content_type) tuple and the files= four-element (filename, content, content_type, headers) tuple into multipart/form-data part headers without validating header names or values. CR or LF characters can terminate a part header, inject additional part headers, or end the part header block early, allowing a downstream multipart parser to treat attacker-supplied lines as genuine headers and potentially alter part semantics or bypass header-based checks. This issue is fixed in version 2.11.0.

CVE

CVE-2026-84379

CWE

93

CVSS base score

5.3

Published

2026-09-02

OWASP

A03 Injection

Orthogonal defect classification

Interface

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

HTTPX2

Fixed by upgrading

Yes

Solution

Upgrade HTTPX2 to version 2.11.0 or later.

import re
from typing import Tuple, Dict, Iterable

class FileField:
    def __init__(self, name: str, file_tuple: Tuple[str, bytes, str, Dict[str, str]]):
        self.name = name
        self.filename, self.content, self.content_type, self.extra_headers = file_tuple

    # VULNERABLE: interpolates unsanitized content_type and headers into multipart part header
    def render_headers(self) -> str:
        lines = [
            f'Content-Disposition: form-data; name="{self.name}"; filename="{self.filename}"',
            f'Content-Type: {self.content_type}'
        ]
        for k, v in self.extra_headers.items():
            lines.append(f'{k}: {v}')
        return "\r\n".join(lines) + "\r\n\r\n"

import re
from typing import Tuple, Dict, Iterable

class FileField:
    def __init__(self, name: str, file_tuple: Tuple[str, bytes, str, Dict[str, str]]):
        self.name = name
        self.filename, self.content, self.content_type, self.extra_headers = file_tuple

    # FIX: sanitizes CR/LF in content_type and header values to prevent injection
    def render_headers(self) -> str:
        def sanitize(value: str) -> str:
            return re.sub(r'[\r\n]', '', value)

        safe_content_type = sanitize(self.content_type)
        lines = [
            f'Content-Disposition: form-data; name="{self.name}"; filename="{self.filename}"',
            f'Content-Type: {safe_content_type}'
        ]
        for k, v in self.extra_headers.items():
            safe_k = sanitize(k)
            safe_v = sanitize(v)
            lines.append(f'{safe_k}: {safe_v}')
        return "\r\n".join(lines) + "\r\n\r\n"

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202684379,
  title        = {{HTTPX2 multipart header injection via unvalidated content_type and custom headers.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-84379},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-84379/}}
}