Description

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault() processing checks each default header independently rather than treating the two framing headers as mutually exclusive. Fixed-size byte, JSON, form, and known-length multipart bodies can therefore be serialized over HTTP/1.1 with both headers, allowing request smuggling or connection desynchronization when downstream intermediaries disagree about which framing header takes precedence. This issue is fixed in version 2.11.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.6",
  "pubDate": "2026-09-02T18:21:29.513Z",
  "pubdate": "2026-09-02T18:21:29.513Z",
  "executiveSummary": "The HTTPX2 library, prior to version 2.11.0, is susceptible to an HTTP Request Smuggling vulnerability caused by improper header management in the request serialization process.\nThe vulnerability arises when the Request._prepare() function fails to enforce mutual exclusivity between Content-Length and Transfer-Encoding headers.\nThis flaw allows an attacker to craft requests containing both headers, leading to potential desynchronization between downstream HTTP intermediaries (such as proxies, load balancers, or web application firewalls) and the origin server.\nSuccessful exploitation can result in request smuggling, where an attacker's request is interpreted differently by various components in the chain, potentially leading to unauthorized access, cache poisoning, or session hijacking.\nThe vulnerability affects all users of HTTPX2 versions prior to 2.11.0. Mitigation requires upgrading the library to version 2.11.0 or later to ensure proper header validation logic is applied.",
  "technicalDetails": "The vulnerability resides within the Request._prepare() method located in src/httpx2/httpx2/_models.py. The root cause is a flaw in the application's header handling logic, specifically regarding the use of the setdefault() method when preparing HTTP requests.\nIn the affected versions, the library independently evaluates the presence of default headers without recognizing the security-critical relationship between Content-Length and Transfer-Encoding headers. According to RFC 7230, these headers are mutually exclusive for message framing; if both are present in an HTTP/1.1 request, it can cause significant ambiguity regarding message length and boundary definition.\nWhen a user supplies a custom Transfer-Encoding header, the library's internal logic fails to prevent the subsequent addition of a body-derived Content-Length header. This allows for the construction of a malformed request packet that explicitly contains both framing headers.\nThe attack flow proceeds as follows: 1) An attacker sends a crafted request containing both Transfer-Encoding and Content-Length headers via an HTTPX2-based client to an intermediary server. 2) The intermediary and the backend server may interpret the message boundaries differently—one prioritizing Transfer-Encoding and the other prioritizing Content-Length. 3) This disparity leads to desynchronization, where the remainder of the attacker's payload is treated as the start of a subsequent request by the backend, or a portion of the legitimate traffic is misinterpreted.\nThis behavior facilitates HTTP Request Smuggling (HRS). By smuggling a request, an attacker can bypass security controls, hijack subsequent requests from other users, or poison web caches. The impact is highly dependent on the architecture of the infrastructure sitting between the client and the target server, as the discrepancy must exist between these two entities to successfully desynchronize the connection.\nThe vulnerability exists in all HTTPX2 versions before 2.11.0. Exploitation does not necessarily require high privileges on the backend server, as the attack is orchestrated via legitimate HTTP traffic, though it requires specific network exposure where the client library communicates through vulnerable or misconfigured intermediaries."
}