CVE-2026-84378

Katalog CVE

CVSS 5.9 · Medium EPSS 0,32%

Kerentanan Inefficient Algorithmic Complexity. Skor CVSS 3.1 5.9 (Medium) menurut github.com.

Deskripsi (NVD)

HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.py repeatedly copies and rescans buffered text in _SSELineDecoder.decode() when an attacker-controlled or compromised SSE endpoint splits one unterminated line across many response chunks. The behavior affects httpx2.Client.sse() and httpx2.AsyncClient.sse(), and the total processing work grows quadratically with the line length, allowing a crafted stream to consume excessive CPU and block a synchronous worker or asynchronous event loop. This issue is fixed in version 2.10.0.

Rincian

Terbit di NVD

2 September 2026

Terakhir diubah

9 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

5.9 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-407: Inefficient Algorithmic Complexity

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 22,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/pydantic/httpx2/commit/cbfc0e04ef6507da29ccbb3b9c2e5b23dd693414
• https://github.com/pydantic/httpx2/pull/1071
• https://github.com/pydantic/httpx2/pull/1117
• https://github.com/pydantic/httpx2/releases/tag/v2.10.0
• https://github.com/pydantic/httpx2/security/advisories/GHSA-f2fp-rgf2-35cp