HTTP Client Vulnerability in HTTPX2 Affects Users of Pydantic

CVE-2026-84380

What is CVE-2026-84380?

In HTTPX2, a next-generation HTTP client for Python, there exists a flaw in the Request._prepare() method found in src/httpx2/httpx2/_models.py. Before version 2.11.0, it is possible for the method to improperly add a Content-Length header that is derived from the request body while simultaneously maintaining a caller-supplied Transfer-Encoding header. This issue arises because the default header handling logic does not enforce mutual exclusivity between these framing headers. As a result, when dealing with certain body types like fixed-size byte arrays, JSON, forms, or predefined-length multipart bodies, both headers can coexist in an HTTP/1.1 request, potentially leading to request smuggling or connection desynchronization issues when intermediaries interpret header precedence differently. The issue has been resolved in version 2.11.0.

References