DEBIAN-CVE-2026-84380
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-84380
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-84380.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-84380
- Upstream
- Published
- 2026-09-02T18:21:29Z
- Modified
- 2026-09-10T08:47:28Z
- Severity
-
- 5.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
- Summary
- [none]
- Details
-
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault() processing checks each default header independently rather than treating the two framing headers as mutually exclusive. Fixed-size byte, JSON, form, and known-length multipart bodies can therefore be serialized over HTTP/1.1 with both headers, allowing request smuggling or connection desynchronization when downstream intermediaries disagree about which framing header takes precedence. This issue is fixed in version 2.11.0.
- References
Affected packages
Debian:14 / python-httpx2
Package
- Name
- python-httpx2
- Purl
- pkg:deb/debian/python-httpx2?arch=source&distro=forky