CyberRota Analysis
AI-GeneratedThe HTTPX2 client for Python prior to version 2.12.0 is vulnerable due to its content decoders, which fully inflate large compressed network chunks, potentially leading to severe memory pressure or out-of-memory conditions. Attackers can exploit this vulnerability by sending specially crafted responses from a compromised server, impacting applications that utilize HTTPX2 for streaming data. Organizations using affected versions should prioritize upgrading to version 2.12.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iter_bytes() or aiter_bytes() yields bounded pieces to the application. A 64 KiB compressed chunk can expand to approximately 64 MiB in one intermediate allocation, so an attacker-controlled or compromised server can cause severe memory pressure or out-of-memory process termination even when the application streams the response. This issue is fixed in version 2.12.0.