CVE-2026-84382: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-84382 is a decompression amplification ("zip bomb") vulnerability in HTTPX2, a next-generation HTTP client for Python maintained by Pydantic. Prior to version 2.12.0, the content decoders in src/httpx2/httpx2/_decoders.py fully inflate each compressed network chunk (gzip, deflate, Brotli, or Zstandard) into a single intermediate allocation before yielding bounded pieces to the application. This means a 64 KiB compressed chunk can expand to approximately 64 MiB in one allocation, even when the application streams the response. The vulnerability was disclosed on August 18, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-409 (Improper Handling of Highly Compressed Data / Data Amplification). HTTPX2's default transport reads the socket in chunks of up to 64 KiB; before version 2.12.0, each chunk was passed to a single decompress() call that fully inflated the data into one intermediate buffer before re-chunking it for the application. At DEFLATE's maximum compression ratio of roughly 1032:1, this allows a 64 KiB compressed chunk to expand to ~64 MiB per allocation; Brotli and Zstandard can cause similarly large amplification. The vulnerability resides in the DeflateDecoder, GZipDecoder, BrotliDecoder, ZStandardDecoder, and MultiDecoder classes in _decoders.py, and affects any application that fetches resources from untrusted or attacker-influenced servers — such as webhook receivers, link unfurlers, crawlers, SSRF-reachable fetchers, and redirect followers — regardless of whether streaming is used (GitHub Advisory, Fix PR).

Successful exploitation causes severe memory pressure or out-of-memory (OOM) process termination on the host running the vulnerable HTTPX2 client. There is no confidentiality or integrity impact; the sole consequence is a Denial of Service (DoS) affecting availability. Because no authentication or user interaction is required beyond the client issuing a request to an attacker-controlled or compromised server, any application using HTTPX2 < 2.12.0 to fetch external content is at risk of being crashed or rendered unresponsive (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only that the victim application send an HTTP request to an attacker-controlled server, making it trivially triggerable in scenarios involving user-supplied URLs, webhooks, or SSRF-reachable endpoints (Red Hat CVE, GitHub Advisory).

1. Set up a malicious server: Configure an HTTP server that responds with a highly compressed body (e.g., a "zip bomb" crafted with gzip, deflate, Brotli, or Zstandard) using a Content-Encoding header matching the chosen algorithm.
2. Craft the compressed payload: Generate a maximally compressed payload — for example, a gzip-compressed stream of repeated bytes that expands to hundreds of MiB when decompressed. At DEFLATE's ~1032:1 ratio, a 64 KiB chunk can expand to ~64 MiB per allocation.
3. Induce the victim to make a request: Exploit a feature of the target application (e.g., a webhook URL, link preview, crawler, or SSRF vector) to cause it to issue an HTTPX2 HTTP GET request to the malicious server.
4. Trigger decompression amplification: The vulnerable HTTPX2 client receives the compressed response and calls decompress() on each 64 KiB chunk without bounding the output, causing a massive intermediate memory allocation per chunk.
5. Achieve Denial of Service: Repeated or sustained responses exhaust the process's available memory, resulting in severe memory pressure or OOM termination of the application (GitHub Advisory, Fix PR).

• Process: Sudden spike in memory consumption of the Python process running HTTPX2, potentially followed by OOM killer termination (visible in system logs as Out of memory: Kill process).
• Logs: Application crash logs or OOM errors correlated with outbound HTTP requests to external or user-supplied URLs; Python MemoryError tracebacks referencing _decoders.py.
• Network: Outbound HTTP requests to unexpected or user-controlled endpoints returning large Content-Encoding: gzip/deflate/br/zstd responses with small response body sizes but high decompressed output; unusually high inbound compressed traffic volume relative to decompressed size.

Upgrade HTTPX2 to version 2.12.0 or later, which reworks all content decoders to decompress responses incrementally with bounded intermediate buffers (maximum 1 MiB per decode step), including responses with multiple stacked content encodings. No configuration-based workaround is available in affected versions; the fix requires a code change. As an interim measure, operators can implement network-level controls to restrict which external servers the application may contact, reducing the attack surface for attacker-controlled server scenarios (GitHub Advisory, Release v2.12.0).

The fix was developed and merged by Kludex (a Pydantic maintainer) on August 18, 2026, with the security advisory credited to reporter tawAsh1. The release notes for v2.12.0 highlighted the bounded decompression change as a key security improvement. Red Hat tracked the issue via Bugzilla (bug #2527702) and published a CVE advisory, indicating awareness among enterprise Linux distributors. No significant broader media coverage or notable researcher commentary beyond the GitHub advisory and standard CVE aggregator coverage has been observed (GitHub Advisory, Release v2.12.0, Red Hat CVE).