HTTPX2 CVE-2026-84378

The target application must be running HTTPX2 version 2.5.0 through 2.9.x and must invoke httpx2.Client.sse() or httpx2.AsyncClient.sse() - the vulnerability exists only on the SSE code path, not on ordinary HTTP requests. The attacker must be able to control the response delivered to the client: either by operating the SSE endpoint the client connects to (a malicious third-party service), by compromising a legitimate SSE server the client trusts, or by executing a network-level MITM between the client and a server using plain HTTP. Applications using HTTPX2 exclusively for non-SSE requests, or those connecting only to internal SSE endpoints over TLS with strong certificate pinning, are not exploitable. No authentication is required from the attacker's perspective once endpoint control is established.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects the threat model: the attack is network-delivered and requires no privileges, but AC:H captures the non-trivial prerequisite that the attacker must control or have compromised the SSE endpoint the client connects to. This is a meaningful barrier - the vulnerability cannot be triggered by a passive observer or a random internet scanner, but by a malicious server operator or a successful MITM or supply-chain compromise of a trusted SSE service. The impact is purely availability: CPU saturation of a worker thread or event loop with no confidentiality or integrity consequences. No KEV listing and no public exploit code have been identified. Even a mid-sized development team in kalisz running httpx2-powered microservices against external SSE feeds should treat upgrading to 2.10.0 as standard maintenance rather than emergency response, because real-world risk is gated on the ability to serve a crafted SSE response to the client. Applications that connect exclusively to internal, trusted SSE endpoints face substantially lower residual risk than those proxying or aggregating external SSE sources.

An attacker operates a malicious HTTP server (or performs MITM on a connection to a trusted SSE service) and accepts the client's SSE request. The server returns a valid text/event-stream response and begins streaming a single SSE event whose data line is tens of kilobytes long, delivered in thousands of one-byte chunks. Each chunk causes _SSELineDecoder.decode() to rescan the entire accumulated buffer, and with a 100 KB line split across 100,000 chunks the total character operations reach approximately 5 × 10⁹, consuming the target process's CPU for an extended period and blocking all other processing in the same thread or event loop.