CVE-2026-84378: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-84378 is a quadratic algorithmic complexity (ReDoS-style CPU exhaustion) vulnerability in the Server-Sent Events (SSE) parser of HTTPX2, a next-generation Python HTTP client maintained by Pydantic. Affected versions are >= 2.5.0 and < 2.10.0; the issue was fixed in version 2.10.0. The vulnerability was published on September 2, 2026, with the security advisory authored by Kludex and credited to reporter GalaxySnail. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is inefficient algorithmic complexity (CWE-407) combined with unchecked input for loop condition (CWE-606) in _SSELineDecoder.decode() within src/httpx2/httpx2/_sse.py. Before version 2.10.0, the decoder concatenated the entire accumulated buffer with each newly received chunk and then rescanned the combined string for line separators; for n fixed-size chunks comprising a single unterminated line, this produces O(n²) copy-and-scan operations. The vulnerability is exploitable by any attacker who controls or can compromise an SSE endpoint that the victim application connects to, requiring no authentication or user interaction on the client side. The fix (PR #1117, commit cbfc0e0) refactors _SSELineDecoder to accumulate incomplete line fragments in a list and join them only when a line separator arrives, reducing complexity to O(n). Additionally, PR #1071 introduced a default 1 MiB max_event_size cap to bound total buffered SSE event data (GitHub Advisory, PR #1117, PR #1071).

Successful exploitation causes excessive CPU consumption in the client process consuming the malicious SSE stream, which can block a synchronous worker thread or stall an asynchronous event loop, degrading availability for all other work in that process. Confidentiality and integrity are not affected — the vulnerability is a pure denial-of-service condition. Applications that connect to third-party or user-supplied SSE endpoints (e.g., AI streaming APIs, real-time data feeds) via httpx2.Client.sse() or httpx2.AsyncClient.sse() are at greatest risk, as a single crafted stream can render the consuming process unresponsive (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The NVD SSVC assessment classifies exploitation as "none" and the attack as not automatable, reflecting the requirement that the attacker must control or compromise an SSE endpoint that the target application actively connects to. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attack complexity is rated High because exploitation depends on the client application connecting to an attacker-controlled SSE server.

1. Set up a malicious SSE server: Deploy an HTTP server that responds to SSE requests (Content-Type: text/event-stream) and streams a single very long line split across thousands of small chunks, never sending a newline (\n) character until the line is complete.
2. Lure or position the target: Cause a vulnerable application using httpx2.Client.sse() or httpx2.AsyncClient.sse() (versions 2.5.0–2.9.x) to connect to the attacker-controlled endpoint — for example, by supplying a malicious URL via user input, a compromised configuration, or a supply-chain attack on a trusted SSE data source.
3. Stream the crafted payload: Send the SSE response body as many small chunks (e.g., 1,000+ chunks of a few bytes each) without any line terminator, forcing _SSELineDecoder.decode() to repeatedly concatenate and rescan the growing buffer on every chunk received.
4. Exhaust CPU: The O(n²) processing causes CPU usage to spike; for sufficiently large n, the synchronous worker thread or async event loop processing the stream becomes fully occupied, blocking all other requests or tasks in the same process (GitHub Advisory, PR #1117).

• Process: Sustained near-100% CPU usage on a single Python worker thread or event loop thread while an SSE connection is active, with no corresponding increase in network throughput or event output.
• Network: Long-lived HTTP connections to an SSE endpoint that deliver data in many tiny chunks (e.g., 1–8 bytes per chunk) without line terminators for an extended period; unusually high chunk count relative to data volume.
• Logs: Application logs showing SSE stream connections that remain open for an abnormally long time without emitting parsed events; timeout or watchdog alerts triggered by unresponsive worker threads or event loops.
• Application behavior: Synchronous HTTP workers becoming unresponsive or async tasks queuing up while an SSE consumer is active, resulting in downstream request timeouts or dropped connections.

Upgrade HTTPX2 to version 2.10.0 or later, which fixes the quadratic complexity by accumulating line fragments in a list and joining only on separator arrival, and enforces a default 1 MiB max_event_size cap per event (GitHub Release). If immediate upgrade is not possible, restrict httpx2.Client.sse() and httpx2.AsyncClient.sse() calls to trusted, internally controlled SSE endpoints only. Additionally, enforce external time budgets or connection timeouts on SSE streams to limit the window of CPU exhaustion, and monitor CPU usage for processes consuming SSE data (GitHub Advisory).

The advisory was published by Kludex (a Pydantic maintainer) on August 18, 2026, with the fix already shipped in v2.10.0 on August 9, 2026 — meaning the patch preceded the public advisory. The v2.10.0 release notes highlight the SSE parsing improvement as a 35x performance gain on fragmented streams, framing it as both a security fix and a performance enhancement. The vulnerability was also noted in the context of the Model Context Protocol Python SDK, where downstream consumers discussed lifting or adjusting the new default max_event_size cap for their use cases (GitHub Release, PR #1071).