{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/httpx2--2.12.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:httpx2:httpx2:*:*:*:*:*:python:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-84382"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["httpx2 (\u003c 2.12.0)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","memory-exhaustion"],"_cs_type":"advisory","_cs_vendors":["HTTPX2"],"content_html":"\u003cp\u003eThe HTTPX2 Python library, used for making HTTP requests, contains a vulnerability (CVE-2026-84382) involving how it processes compressed response bodies. Prior to version 2.12.0, the library's default transport mechanism fully decompressed each incoming network read chunk (up to 64 KiB) into an intermediate memory buffer before yielding the data to the consuming application.\u003c/p\u003e\n\u003cp\u003eBecause of this lack of bounded memory allocation during decompression, an attacker controlling a remote server can provide a highly compressed payload using algorithms like Gzip, Deflate, Brotli, or Zstd. At the maximum compression ratio for DEFLATE, which is approximately 1032:1, a 64 KiB chunk can expand into roughly 64 MiB of memory in a single allocation. Even if the application logic intends to stream data to keep memory usage low, these transient, uncontrolled allocations occur during the underlying decompression phase. This behavior exposes applications that interact with untrusted third-party servers to memory pressure or total service failure via out-of-memory (OOM) termination.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eApplications that fetch resources from untrusted or attacker-influenced origins are at significant risk. This includes webhook receivers, link unfurlers, web crawlers, SSRF-prone services, and automated tools that follow HTTP redirects. Exploitation requires no authentication or user interaction beyond triggering the application to perform an HTTP request to the attacker-controlled server. Successful exploitation results in process crashes or severe performance degradation due to memory exhaustion, effectively causing a denial-of-service.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the upgrade of the HTTPX2 library to version 2.12.0 or later across all applications that perform egress HTTP requests to untrusted endpoints. Version 2.12.0 introduces bounded, incremental decompression buffers to prevent uncontrolled memory spikes. Audit internal infrastructure to identify services leveraging HTTPX2 for fetching external resources, particularly in SSRF-sensitive environments, and ensure dependencies are updated via package management tools.\u003c/p\u003e\n","date_modified":"2026-09-08T21:53:14Z","date_published":"2026-09-08T21:53:14Z","id":"https://feed.craftedsignal.io/briefs/2026-09-httpx2-decompression-amplification/","summary":"The HTTPX2 library, prior to version 2.12.0, is vulnerable to a decompression amplification attack where malicious compressed HTTP responses can trigger large, unbonded memory allocations, leading to denial-of-service via memory exhaustion.","title":"HTTPX2 Decompression Amplification Vulnerability (CVE-2026-84382)","url":"https://feed.craftedsignal.io/briefs/2026-09-httpx2-decompression-amplification/"}],"language":"en","title":"CraftedSignal Threat Feed - Httpx2 (\u003c 2.12.0)","version":"https://jsonfeed.org/version/1.1"}