CVE-2026-84382

Name of the Vulnerable Software and Affected Versions HTTPX2 versions prior to 2.12.0

Description Content decoders in src/httpx2/httpx2/ decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before the iter bytes() or aiter bytes() functions yield bounded pieces to the application. This behavior allows a compromised or attacker-controlled server to trigger severe memory pressure or out-of-memory process termination by sending compressed chunks that expand significantly during intermediate allocation, even if the application is streaming the response.

Recommendations Update to version 2.12.0.