Description

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attacker-controlled content_type values and custom headers from the files= three-element (filename, content, content_type) tuple and the files= four-element (filename, content, content_type, headers) tuple into multipart/form-data part headers without validating header names or values. CR or LF characters can terminate a part header, inject additional part headers, or end the part header block early, allowing a downstream multipart parser to treat attacker-supplied lines as genuine headers and potentially alter part semantics or bypass header-based checks. This issue is fixed in version 2.11.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T18:21:29.300Z",
  "pubdate": "2026-09-02T18:21:29.300Z",
  "executiveSummary": "The vulnerability in HTTPX2 constitutes a header injection flaw within the multipart/form-data generation logic. Affecting versions prior to 2.11.0, this issue arises from the improper handling of user-supplied input when constructing part headers.\nBy manipulating the content_type or custom headers provided via the files= tuple, an attacker can inject CR (Carriage Return) and LF (Line Feed) characters. This enables the injection of arbitrary headers or the premature termination of the header block, effectively allowing the manipulation of multipart message structure.\nThe primary risk involves the subversion of downstream multipart parsers, which may process injected content as legitimate headers, potentially leading to security bypasses, data exfiltration, or modification of part semantics. The vulnerability is exploitable by an attacker capable of controlling the parameters passed to the multipart file upload functionality, requiring no specific privileges other than the ability to influence the client-side request construction.",
  "technicalDetails": "The vulnerability originates in src/httpx2/httpx2/_multipart.py within the FileField.render_headers() function. This method is responsible for generating the headers for individual parts of a multipart/form-data request when using the files= parameter in HTTPX2. The implementation fails to sanitize input derived from the three-element (filename, content, content_type) or four-element (filename, content, content_type, headers) tuples passed to the client.\nSpecifically, the render_headers() function performs direct interpolation of the content_type and custom headers strings into the multipart part stream without verifying the presence of control characters. Because the HTTP specification uses CRLF sequences to delimit headers, the inclusion of CR (0x0D) or LF (0x0A) characters allows an attacker to break out of the intended header field context. By injecting these sequences, an attacker can prematurely terminate the current header block or insert entirely new, unauthorized headers into the multipart request body.\nThe attack flow follows a structured path: First, the attacker identifies an interface where the application utilizes HTTPX2 to perform multipart file uploads. Second, the attacker crafts a malicious input tuple, embedding newline sequences within the 'content_type' string or the 'headers' dictionary. For example, injecting a payload such as 'text/plain\\r\\nInjected-Header: value' forces the parser to interpret 'Injected-Header: value' as a legitimate part of the multipart metadata rather than part of the content type string.\nWhen a downstream multipart parser processes this malformed request, it interprets the injected characters as line breaks, treating subsequent lines as new, genuine part headers. This allows an attacker to alter the perceived content disposition, modify the MIME type, or introduce secondary headers that may bypass security filters implemented by the receiving server. Since the header block is ended early, the attacker can effectively manipulate the boundary between headers and the body of the multipart part, potentially leading to request smuggling or protocol-level confusion. This flaw affects all versions of HTTPX2 before 2.11.0 and does not require elevated privileges or specific authentication, provided the application allows user-controlled inputs to reach the multipart serialization routine."
}