httpx2 vulnerabilities

2 known vulnerabilities in httpx2 from Pydantic. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  httpx2: Improper Handling of Highly Compressed Data (Data Amplification)

  CVE-2026-84382Sep 2, 2026Pydantic

  HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iter_bytes() or aiter_bytes() yields bounded pieces to the app

• 8.1 High severity

  httpx2: Cleartext Transmission of Sensitive Information

  CVE-2026-84381Sep 2, 2026Pydantic

  HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/_sync/socks_proxy.py and src/httpcore2/httpcore2/_async/socks_proxy.py when the remote origin uses wss through a SOCKS5 proxy because t