CVE-2026-84379

Name of the Vulnerable Software and Affected Versions HTTPX2 versions prior to 2.11.0

Description The FileField.render headers() function in src/httpx2/httpx2/ multipart.py fails to validate header names or values when interpolating content type values and custom headers from the files tuple. This allows the injection of Carriage Return (CR) or Line Feed (LF) characters, which can terminate part headers, inject additional headers, or end the header block prematurely. Consequently, a downstream multipart parser may interpret attacker-supplied lines as legitimate headers, potentially altering part semantics or bypassing header-based security checks.

Recommendations Update to version 2.11.0.