CVE-2026-84382: HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)
When decoding a compressed response body (gzip, deflate, br, or zstd), HTTPX2 fully decompressed each network read before yielding content to the application. A small compressed input could therefore cause a large intermediate memory allocation, even when the application streamed the response to keep memory usage bounded.
References
- github.com/advisories/GHSA-8xx6-hgc6-gc2m
- github.com/pydantic/httpx2/commit/4fd0c70a3f207c618b145934792f791bccfb39f8
- github.com/pydantic/httpx2/pull/1126
- github.com/pydantic/httpx2/releases/tag/v2.12.0
- github.com/pydantic/httpx2/security/advisories/GHSA-8xx6-hgc6-gc2m
- nvd.nist.gov/vuln/detail/CVE-2026-84382
Code Behaviors & Features
Detect and mitigate CVE-2026-84382 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →