CVE-2026-84378

Name of the Vulnerable Software and Affected Versions HTTPX2 versions 2.5.0 through 2.9.0

Description The Server-Sent Events (SSE) parser in src/httpx2/httpx2/ sse.py repeatedly copies and rescans buffered text within the SSELineDecoder.decode() function when an SSE endpoint splits a single unterminated line across multiple response chunks. This behavior affects httpx2.Client.sse() and httpx2.AsyncClient.sse(). Because the processing work increases quadratically relative to the line length, a specially crafted stream can cause excessive CPU consumption, potentially blocking a synchronous worker or an asynchronous event loop.

Recommendations Update to version 2.10.0.