CVE-2026-84380

Name of the Vulnerable Software and Affected Versions HTTPX2 versions prior to 2.11.0

Description The Request. prepare() function in src/httpx2/httpx2/ models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. This occurs because the setdefault() processing checks each default header independently instead of treating the two framing headers as mutually exclusive. Consequently, fixed-size byte, JSON, form, and known-length multipart bodies can be serialized over HTTP/1.1 with both headers, which may lead to request smuggling or connection desynchronization if downstream intermediaries disagree on which framing header takes precedence.

Recommendations Update to version 2.11.0.