Vulnerabilities for httpx2

First version without a known vulnerability: 2.12.0

Details

• GHSA-8xx6-hgc6-gc2m2026-09-08

  HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

  Fixed in: 2.12.0

• GHSA-pf96-p4fj-65662026-09-08

  HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

  Fixed in: 2.11.0

• GHSA-h4x7-gw46-3wm62026-09-08

  HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers

  Fixed in: 2.11.0

• GHSA-f2fp-rgf2-35cp2026-09-08

  HTTPX2: Quadratic SSE line buffering can cause CPU denial of service

  Fixed in: 2.10.0

• GHSA-7mj9-2mp8-4m2p2026-09-08

  HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies

  Fixed in: 2.10.0