Description

HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.py repeatedly copies and rescans buffered text in _SSELineDecoder.decode() when an attacker-controlled or compromised SSE endpoint splits one unterminated line across many response chunks. The behavior affects httpx2.Client.sse() and httpx2.AsyncClient.sse(), and the total processing work grows quadratically with the line length, allowing a crafted stream to consume excessive CPU and block a synchronous worker or asynchronous event loop. This issue is fixed in version 2.10.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-02T18:21:29.153Z",
  "pubdate": "2026-09-02T18:21:29.153Z",
  "executiveSummary": "A ReDoS-like algorithmic complexity vulnerability exists in the HTTPX2 Server-Sent Events (SSE) parser, specifically within the _SSELineDecoder.decode() method. By sending a maliciously crafted stream consisting of a long, unterminated line split across multiple response chunks, an attacker can force the parser to perform redundant copying and rescanning operations.\nThis vulnerability leads to a denial-of-service (DoS) condition by inducing quadratic time complexity relative to the line length. The resource exhaustion consumes excessive CPU cycles, effectively blocking synchronous workers and stalling asynchronous event loops within applications utilizing httpx2.Client.sse() or httpx2.AsyncClient.sse().\nAffected products include HTTPX2 versions 2.5.0 through 2.9.x. The vulnerability requires no special authentication, as it is triggered through the standard processing of an attacker-controlled or compromised SSE endpoint. Successful exploitation results in severe performance degradation or complete service unavailability for the consuming application.",
  "technicalDetails": "The vulnerability resides in the src/httpx2/httpx2/_sse.py file within the _SSELineDecoder.decode() function. The root cause is inefficient buffer management during the handling of SSE stream fragments. When the SSE parser receives a response chunk, it attempts to reconstruct lines from the byte stream; however, the implementation improperly handles unterminated lines that are fragmented across multiple packets.\nSpecifically, the decoder repeatedly performs memory copies and rescans of the entire buffer each time a new partial chunk is appended to the internal state. Because the implementation does not efficiently maintain a persistent pointer or incremental state for the existing buffer, the processing workload follows a quadratic growth pattern (O(n^2)) where n represents the total length of the fragmented line.\nThe attack flow proceeds as follows: 1) An attacker initiates an SSE connection to the client via a malicious or compromised endpoint. 2) The attacker sends a continuous stream of data designed to look like a single, extremely long SSE line, deliberately omitting the standard line termination characters (CRLF or LF). 3) The attacker distributes this long line across a multitude of small TCP segments or response chunks. 4) As each chunk arrives, the _SSELineDecoder.decode() method processes the accumulated buffer, re-scanning the entire concatenated data to identify line boundaries.\nThis recursive re-processing of the buffer state forces the client CPU to perform redundant memory operations. In a synchronous environment, this blocks the main execution thread, preventing the handling of other requests. In an asynchronous environment using httpx2.AsyncClient.sse(), the CPU-intensive nature of the buffer re-scanning can block the event loop, causing latency spikes or timeouts for all other concurrent tasks managed by that loop.\nThe vulnerability is present in versions 2.5.0 up to 2.10.0. The lack of validation or length limits on the incoming SSE buffer allows an attacker to control the scale of the CPU consumption, effectively turning the client's own parsing logic into a weaponized resource exhaustion vector. Because the parser assumes well-formed SSE inputs and lacks a strategy for handling fragmented, unbounded lines, it remains susceptible to any stream source that can influence the chunking and content length of the SSE response."
}