Server-Sent Events Parser Issue in HTTPX2 Client for Python

CVE-2026-84378

What is CVE-2026-84378?

The HTTPX2 client for Python is impacted by a vulnerability in its Server-Sent Events (SSE) parser. When processing SSE data, the parser can be exploited by a maliciously crafted stream that splits unterminated lines across response chunks. This results in the parser repeatedly copying and rescanning buffered text, leading to excessive CPU usage. The issue primarily affects the sse() functions in both the synchronous and asynchronous HTTPX2 clients, potentially causing significant performance degradation. This vulnerability can block synchronous workers or asynchronous event loops, creating a denial of service condition. It has been addressed in version 2.10.0.

References