HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
Priority MEDIUM 63CWE-93Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 2 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attacker-controlled content_type values and custom headers from the files= three-element (filename, content, content_type) tuple and the files= four-element (filename, content, content_type, headers) tuple into multipart/form-data part headers without validating header names or values. CR or LF characters can terminate a part header, inject additional part headers, or end the part header block early, allowing a downstream multipart parser to treat attacker-supplied lines as genuine headers and potentially alter part semantics or bypass header-based checks. This issue is fixed in version 2.11.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00317 24th percentileScored 2026-11-07
Fix Partial httpx2 (pydantic): 2.11.0httpx2 (PyPI): 2.11.0Red Hat: 7 advisoriesRed Hat: 2 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pydantic | httpx2 | before 2.11.0 | 2.11.0 | Patch available | CNA |
| — | httpx2 (PyPI) | before 2.11.0 | 2.11.0 | Patch available | GHSA-h4x7-gw46-3wm6 |
- httpx2 Vendorpydantic Affected before 2.11.0 Fixed in 2.11.0 Patch available CNA
- httpx2 (PyPI) Vendor— Affected before 2.11.0 Fixed in 2.11.0 Patch available GHSA-h4x7-gw46-3wm6
Remediation
- Fix · CNA httpx2 (pydantic) Fixed in 2.11.0
- Fix · GHSA-h4x7-gw46-3wm6 httpx2 (PyPI) Fixed in 2.11.0 Advisory →
Red Hat 7 advisories
- RHSA-2026:92452 Released 2026-10-29 · Red Hat rating CriticalRed Hat Enterprise Linux AI 3.5.2 enhancement update
- Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
- RHSA-2026:92449 Released 2026-10-29 · Red Hat rating CriticalRed Hat Enterprise Linux AI 3.5.2 enhancement update
- Red Hat Enterprise Linux AI 3.5 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
- RHSA-2026:82415 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (cpu)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cpu-rhel9
Show 4 more Red Hat advisories
- RHSA-2026:82371 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (spyre)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-spyre-rhel9
- RHSA-2026:82368 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (cuda)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-cuda-rhel9
- RHSA-2026:82061 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference Tech Preview 3.5.2 (Gaudi)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-gaudi-rhel9
- RHSA-2026:82059 Released 2026-10-13 · Red Hat rating CriticalRed Hat AI Inference 3.5.2 (ROCm)
- Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-rocm-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Lightspeed Core | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat AI Inference Server 3.5 | Fixed | RHSA-2026:82059, RHSA-2026:82061, RHSA-2026:82368, RHSA-2026:82371, RHSA-2026:82415 |
| Red Hat Enterprise Linux AI 3.5 | Fixed | RHSA-2026:92449, RHSA-2026:92452 |
Not affected: 2 products
- Migration Toolkit for Applications 8
- Red Hat Enterprise Linux command line assistant
Timeline
- 2026-10-02 Threatist record created from CVE-2026-84379
- 2026-10-03 Alias added: GHSA-h4x7-gw46-3wm6
- 2026-10-13 Fix available: RHSA-2026:82061 · Red Hat
- 2026-10-13 Fix available: RHSA-2026:82059 · Red Hat
- 2026-10-13 Fix available: Red Hat AI Inference Server 3.5 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82368 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82415 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82371 · Red Hat
- 2026-10-15 Affected versions changed · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92452 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92449 · Red Hat
- 2026-10-30 Fix available: Red Hat Enterprise Linux AI 3.5 · Red Hat
References
More pydantic vulnerabilities
- TI-2024-03518 Regular expression denial of service in Pydantic < 2.4.0 CVSS 3.1HIGH 7.5
- TI-2026-41916 Path traversal in pydantic-settings CVSS 3.1MEDIUM 5.3
- TI-2026-20687 Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling CVSS 3.1HIGH 8.6
- TI-2026-57993 HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification) CVSS 3.1HIGH 7.5
- TI-2026-69551 Pydantic AI keeps concurrency slots after streams end early CVSS 3.1HIGH 7.5
- TI-2026-57992 HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies CVSS 3.1HIGH 8.1
Sources
- CVE-2026-84379 · CVE Program
- CVE-2026-84379 · NVD
- FIRST EPSS
- GHSA-h4x7-gw46-3wm6 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-84379 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences