CVE-2026-84380Medium· 5.6▾ SunlitHTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding h…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.4%
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault() processing checks each default header independently rather than treating the two framing headers as mutually exclusive. Fixed-size byte, JSON, form, and known-length multipart bodies can therefore be serialized over HTTP/1.1 with both headers, allowing request smuggling or connection desynchronization when downstream intermediaries disagree about which framing header takes precedence. This issue is fixed in version 2.11.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
httpx2 < 2.11.0Patched in:
httpx2 2.11.0Source: https://osv.dev/vulnerability/GHSA-pf96-p4fj-6566
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84378Medium· 5.9HTTPX2 is a next generation HTTP client for Python
CVE-2026-84379Medium· 5.3HTTPX2 is a next generation HTTP client for Python
CVE-2026-84382High· 7.5HTTPX2 is a next generation HTTP client for Python
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
CVE-2026-85078Medium· 6.5Sanic is an opensource python web server/framework
CVE-2023-54397High· 7.5Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters