CVE-2026-84380: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-84380 is an HTTP request smuggling vulnerability in HTTPX2, a next-generation Python HTTP client maintained by Pydantic. The flaw exists in versions prior to 2.11.0 and allows conflicting Content-Length and Transfer-Encoding headers to be simultaneously present in outbound HTTP/1.1 requests, enabling request smuggling or connection desynchronization attacks. The advisory was published on August 18, 2026, and the fix was released in version 2.11.0 on the same date. It carries a CVSS v3.1 base score of 5.6 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). In Request._prepare() within src/httpx2/httpx2/_models.py, default headers are applied using setdefault() on an individual basis, without checking for mutual exclusivity between Content-Length and Transfer-Encoding. When a caller supplies a Transfer-Encoding: chunked header and a fixed-size body (byte, JSON, form, or known-length multipart), the method independently adds a body-derived Content-Length, resulting in both framing headers being present on the wire. The fix in PR #1137 adds an explicit check: if Transfer-Encoding is already set in the request headers, any auto-generated Content-Length is suppressed, and vice versa (GitHub Advisory, GitHub Commit).

Successful exploitation can allow an attacker to interfere with HTTP requests sharing a persistent connection, bypass front-end routing or authorization decisions, or poison responses and caches in downstream infrastructure. The attack requires an application to forward attacker-controlled Transfer-Encoding headers to HTTPX2 over HTTP/1.1 through a proxy or intermediary that interprets conflicting framing headers differently. Confidentiality, integrity, and availability are all assessed as having low impact, reflecting the conditional nature of exploitation and the dependency on specific downstream infrastructure behavior (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is rated as non-automatable by NVD SSVC, as it requires high attack complexity — specifically, the attacker must control request framing headers passed to HTTPX2, and the target must use HTTP/1.1 through a proxy that misinterprets conflicting headers (Feedly, GitHub Advisory).

1. Identify a target application: Find a Python application using HTTPX2 versions prior to 2.11.0 that acts as a proxy or forwards user-controlled HTTP headers to upstream services over HTTP/1.1.
2. Craft a malicious request: Supply a request to the target application that includes a Transfer-Encoding: chunked header along with a fixed-size body (e.g., raw bytes, JSON, or form data).
3. Trigger the vulnerability: HTTPX2's Request._prepare() will independently apply a body-derived Content-Length header via setdefault(), resulting in an outbound request containing both Transfer-Encoding: chunked and Content-Length: <n>.
4. Exploit intermediary disagreement: Route the ambiguous request through a proxy or load balancer that interprets Content-Length as the authoritative framing header while the backend uses Transfer-Encoding, or vice versa, causing the message boundary to be misread.
5. Achieve smuggling objective: Depending on the infrastructure, inject a prefix into a subsequent request on the same persistent connection, bypass authorization checks, or poison a shared response cache (GitHub Advisory).

Upgrade HTTPX2 to version 2.11.0 or later, which treats Content-Length and Transfer-Encoding as mutually exclusive when applying auto-generated request headers. If immediate upgrading is not possible, remove Transfer-Encoding and other hop-by-hop framing headers from untrusted input before constructing outbound requests with HTTPX2. Applications acting as proxies should derive outbound framing from the body rather than forwarding inbound framing headers. As an additional layer of defense, implement validation at the application or proxy layer to detect and reject requests containing both Content-Length and Transfer-Encoding headers simultaneously (GitHub Advisory, GitHub Release).

The fix was authored and merged by Kludex (a Pydantic maintainer) on August 13, 2026, ahead of the public advisory published on August 18, 2026, indicating a coordinated disclosure process. The release notes for v2.11.0 highlight the fix as a key security improvement under "Request compatibility and validation." No significant broader media coverage or notable external researcher commentary has been identified beyond the official advisory and patch (GitHub Release, GitHub PR).