CVE-2026-84382 pydantic CVE debrief

Who should care

Developers and administrators using HTTPX2 in Python applications, especially those handling untrusted or user-controlled network data, should be aware of this high-severity vulnerability. They should update HTTPX2 to version 2.12.0 or later and implement memory usage monitoring and limits for applications using HTTPX2. Additionally, they should monitor for and restrict suspicious network traffic to prevent potential out-of-memory process termination. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified. Vulnerability management teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Asset inventory managers should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Those responsible for change management should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Those responsible for monitoring and detection should check relevant monitoring, detection, and logs for exposed assets that need extra review. Those responsible for source tracking should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. IT operations teams should implement rollback/change windows for remediation efforts. Security operations teams should implement compensating controls for exposed systems while remediation is scheduled and verified. Those responsible for asset inventory management should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Those responsible for vulnerability management should review compensating controls for exposed systems while remediation is scheduled and verified. Those responsible for change management should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Those responsible for monitoring and detection should check relevant monitoring, detection, and logs for exposed assets that need extra review. Those responsible for source tracking should review the supplied official

Technical summary

The HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iter_bytes() or aiter_bytes() yields bounded pieces to the application. A 64 KiB compressed chunk can expand to approximately 64 MiB in one intermediate allocation, allowing for potential out-of-memory process termination. This issue is fixed in version 2.12.0. Developers should update HTTPX2 to version 2.12.0 or later and implement memory usage monitoring and limits for applications using HTTPX2.

Defensive priority

High-severity vulnerability in HTTPX2, a next-generation HTTP client for Python, allowing for potential out-of-memory process termination via maliciously crafted network chunks.

Recommended defensive actions

• Update HTTPX2 to version 2.12.0 or later
• Monitor for and restrict suspicious network traffic
• Implement memory usage monitoring and limits for applications using HTTPX2
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iter_bytes() or aiter_bytes() yields bounded pieces to the application. A 64 KiB compressed chunk can expand to approximately 64 MiB in one intermediate allocation. This issue can cause severe memory pressure or out-of-memory process termination. Defenders should verify the memory usage of applications using HTTPX2 and monitor for suspicious network traffic.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.