CVE-2026-84382

Memory exhaustion via unbounded decompression of streamed HTTP responses.

• CVSS 7.5
• 409
• Resource Management
• Remote

HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iter_bytes() or aiter_bytes() yields bounded pieces to the application. A 64 KiB compressed chunk can expand to approximately 64 MiB in one intermediate allocation, so an attacker-controlled or compromised server can cause severe memory pressure or out-of-memory process termination even when the application streams the response. This issue is fixed in version 2.12.0.

CVE

CVE-2026-84382

CWE

409

CVSS base score

7.5

Published

2026-09-02

OWASP

A04 Insecure Design

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

HTTPX2

Fixed by upgrading

Yes

Solution

Upgrade httpx2 to version 2.12.0 or newer.

import httpx2

def fetch(url: str) -> bytes:
    """Stream the response while letting httpx2 fully inflate each chunk."""
    # VULNERABLE: full decompression of each network chunk causes memory blow‑up
    with httpx2.Client() as client:
        resp = client.get(url, stream=True)
        data = b""
        for chunk in resp.iter_bytes():
            data += chunk
        return data

import httpx2
import zlib

def fetch(url: str) -> bytes:
    """Stream the response and decompress incrementally to avoid large allocations."""
    # FIX: incremental decompression prevents full in‑memory inflation
    with httpx2.Client() as client:
        resp = client.get(url, stream=True, decode_content=False)
        decompressor = zlib.decompressobj()
        data = b""
        for raw_chunk in resp.aiter_raw():
            data += decompressor.decompress(raw_chunk)
        data += decompressor.flush()
        return data

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202684382,
  title        = {{Memory exhaustion via unbounded decompression of streamed HTTP responses.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-84382},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-84382/}}
}