CVE-2026-84380: Pydantic HTTPX2

Medium severity, CVSS 5.6. EPSS: 0.2% chance of exploitation in the next 30 days.

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault() processing checks each default header independently rather than treating the two framing headers as mutually exclusive. Fixed-size byte, JSON, form, and known-length multipart bodies can therefore be serialized over HTTP/1.1 with both headers, allowing request smuggling or connection desynchronization when downstream intermediaries disagree about which framing header takes precedence. This issue is fixed in version 2.11.0.

Affected products

• Pydantic HTTPX2: before 2.11.0 (fixed in 2.11.0)

Published 2026-09-02. Last modified 2026-09-09.