CVE-2026-84380

HTTPX2 may send both Content‑Length and Transfer‑Encoding, enabling request smuggling.

• CVSS 5.6
• 444
• Design Defects
• Remote

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault() processing checks each default header independently rather than treating the two framing headers as mutually exclusive. Fixed-size byte, JSON, form, and known-length multipart bodies can therefore be serialized over HTTP/1.1 with both headers, allowing request smuggling or connection desynchronization when downstream intermediaries disagree about which framing header takes precedence. This issue is fixed in version 2.11.0.

CVE

CVE-2026-84380

CWE

444

CVSS base score

5.6

Published

2026-09-02

OWASP

A04 Insecure Design

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Design Defects

Subcategory

Security Misconfigurations

Accessibility scope

Remote

Impact

Unauthorized Access

Affected component

httpx2

Fixed by upgrading

Yes

Solution

Upgrade httpx2 to version 2.11.0 or later.

import httpx2

def send_fixed_length(url: str, data: bytes):
    # VULNERABLE: adds Content-Length even when Transfer-Encoding is set
    req = httpx2.Request(
        "POST",
        url,
        headers={"Transfer-Encoding": "chunked"},
        content=data,
    )
    # internal call that triggers _prepare()
    prepared = req._prepare()
    # send using the client (placeholder)
    client = httpx2.Client()
    client.send(prepared)

import httpx2

def send_fixed_length(url: str, data: bytes):
    # FIX: avoid adding Content-Length when Transfer-Encoding is present
    req = httpx2.Request(
        "POST",
        url,
        headers={"Transfer-Encoding": "chunked"},
        content=data,
    )
    # internal call that triggers _prepare()
    prepared = req._prepare()
    # send using the client (placeholder)
    client = httpx2.Client()
    client.send(prepared)

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202684380,
  title        = {{HTTPX2 may send both Content‑Length and Transfer‑Encoding, enabling request smuggling.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-84380},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-84380/}}
}