Memory Pressure Vulnerability in HTTPX2 Client from Pydantic

CVE-2026-84382

What is CVE-2026-84382?

The HTTPX2 client for Python is susceptible to a vulnerability where content decoders fully inflate network chunks of gzip, deflate, br, or zstd formats before yielding pieces to the application. This behavior may allow an attacker to intentionally send a 64 KiB compressed chunk that can expand to approximately 64 MiB, leading to severe memory pressure or potential out-of-memory termination of the application. This issue has been addressed in version 2.12.0.

References