CVE-2026-84382

HTTPX2 before 2.12.0 fully inflates each gzip, deflate, brotli, or zstd network chunk inside its content decoders (src/httpx2/httpx2/_decoders.py) before iter_bytes() or aiter_bytes() yields bounded pieces to the application, so a single 64 KiB compressed chunk can expand to roughly 64 MiB in one intermediate allocation. The flaw (CWE-409, improper handling of highly compressed data) is triggered whenever the client receives a crafted compressed response from a server the attacker controls or has compromised, even if the application streams the response. An attacker gains denial of service — severe memory pressure or out-of-memory termination of the Python process — with no confidentiality or integrity impact, consistent with the CVSS 7.5 availability-only score. All HTTPX2 deployments prior to 2.12.0 are affected; absolute exposure is unknown because no install or download counts are provided. No exploitation is known: there is no public proof-of-concept, the issue is not in CISA KEV, and EPSS estimates only a 0.4% chance of exploitation within 30 days.

What to do: Upgrade to HTTPX2 2.12.0 or later, which bounds decoder allocations. Until upgraded, restrict requests to trusted servers, avoid fetching attacker-controlled or user-influenced URLs, cap response sizes where possible, and monitor client processes for memory spikes or OOM kills. Audit dependency manifests for httpx2 pinned below 2.12.0 and prioritize patching apps that fetch untrusted URLs.