CVE-2026-84379: HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders() in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element (filename, content, contenttype) tuple and the files= four-element (filename, content, contenttype, headers) tuple into multipart/form-data part headers without validating header names or values. CR or LF characters can terminate a part header, inject additional part headers, or end the part header block early, allowing a downstream multipart parser to treat attacker-supplied lines as genuine headers and potentially alter part semantics or bypass header-based checks. This issue is fixed in version 2.11.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
httpx2to a version that resolves this vulnerability.Fixed in 2.11.0
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications using HTTPX2 before 2.11.0 are exposed when they build multipart requests with attacker-controlled values in the files= tuple’s content_type field or, for four-element tuples, custom headers. The impact depends on how the downstream multipart parser interprets injected part headers.
Does exploitation require an authenticated user or user interaction?
No. The supplied vector indicates network exploitation with low complexity, no privileges, and no user interaction; however, the attacker must be able to influence the relevant multipart file content type or custom header values used by the application.
Are ordinary multipart uploads affected by default?
The issue is specifically in unvalidated content_type and custom header values supplied through three- or four-element files= tuples. The provided information does not indicate that multipart requests without attacker-controlled values in those fields are affected.
What should teams do if they cannot update immediately?
Prevent untrusted input from reaching the content_type or custom headers in HTTPX2 files= tuples. Reject or sanitize CR and LF characters in those values to prevent injected multipart part headers.
How can we determine whether our application is affected?
Check whether it uses HTTPX2 versions earlier than 2.11.0 and constructs multipart uploads through files= three- or four-element tuples. Review whether untrusted data can control the content_type value or custom header names or values, especially if the receiving service applies header-based multipart validation.