CVE-2026-84379: HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
Summary
HTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to terminate a multipart part header and inject additional part headers or end the part header block early.
Details
The three-element file tuple accepts (filename, content, contenttype), and the four-element form accepts (filename, content, contenttype, headers). FileField.renderheaders() interpolates the supplied header names and values between CRLF delimiters without validating them.
For example:
python import httpx2
request = httpx2.Request( "POST", "https://example.com/upload", headers={"Content-Type": "multipart/form-data; boundary=BOUNDARY"}, files={ "file": ( "safe.txt", b"payload", "text/plain\r\nX-Injected: true", ) }, )
print(request.read().decode())
The generated body contains an attacker-injected part header:
text --BOUNDARY Content-Disposition: form-data; name="file"; filename="safe.txt" Content-Type: text/plain X-Injected: true
payload --BOUNDARY--
The same issue affects names and values in the custom header mapping from the four-element tuple.
Field names and filenames are serialized through a separate escaping path and do not permit CRLF header injection.
Impact
Applications are affected when they pass attacker-controlled upload metadata into the per-file contenttype or custom headers arguments. The receiving server interprets injected lines as genuine multipart part headers. Depending on how that server validates and processes uploads, this can alter part semantics or bypass checks based on part headers.
This does not split the outer HTTP request: the injected headers are contained within the multipart body. The concrete security impact therefore depends on the downstream multipart parser and application behavior.
Mitigation
Upgrade to HTTPX2 2.11.0 or later. Patched versions reject forbidden control characters in multipart part header names and values and raise ValueError before serializing the request.
If upgrading is not immediately possible, applications should validate custom multipart header names as HTTP field-name tokens. They should reject NUL, CR, LF, other C0 controls except horizontal tab, and DEL in per-file content types and custom header values before passing them to HTTPX2.
Other sources
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders() in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element (filename, content, contenttype) tuple and the files= four-element (filename, content, contenttype, headers) tuple into multipart/form-data part headers without validating header names or values. CR or LF characters can terminate a part header, inject additional part headers, or end the part header block early, allowing a downstream multipart parser to treat attacker-supplied lines as genuine headers and potentially alter part semantics or bypass header-based checks. This issue is fixed in version 2.11.0.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/httpx2to a version that resolves this vulnerability.Fixed in 2.11.0 - Upgrade
Upgrade
HTTPX2to a version that resolves this vulnerability.Fixed in 2.11.0 - Configuration
If upgrading is not possible, validate and reject NUL, CR, LF, other C0 controls except horizontal tab, and DEL in per-file content types and custom header names/values before passing attacker-influenced values to HTTPX2.
HTTPX2 multipart part header handling (files= tuple API) Validate/Reject forbidden control characters in per-file content_type and custom header names/values (NUL, CR, LF, other C0 controls except horizontal tab, DEL) before passing to HTTPX2 = enabled
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications using HTTPX2 before 2.11.0 are exposed when they build multipart requests with attacker-controlled values in the files= tuple’s content_type field or, for four-element tuples, custom headers. The impact depends on how the downstream multipart parser interprets injected part headers.
Does exploitation require an authenticated user or user interaction?
No. The supplied vector indicates network exploitation with low complexity, no privileges, and no user interaction; however, the attacker must be able to influence the relevant multipart file content type or custom header values used by the application.
Are ordinary multipart uploads affected by default?
The issue is specifically in unvalidated content_type and custom header values supplied through three- or four-element files= tuples. The provided information does not indicate that multipart requests without attacker-controlled values in those fields are affected.
What should teams do if they cannot update immediately?
Prevent untrusted input from reaching the content_type or custom headers in HTTPX2 files= tuples. Reject or sanitize CR and LF characters in those values to prevent injected multipart part headers.
How can we determine whether our application is affected?
Check whether it uses HTTPX2 versions earlier than 2.11.0 and constructs multipart uploads through files= three- or four-element tuples. Review whether untrusted data can control the content_type value or custom header names or values, especially if the receiving service applies header-based multipart validation.