HTTPX2: Quadratic SSE line buffering can cause CPU denial of serviceGHSA-f2fp-rgf2-35cp
MEDIUMFix: pydantic/httpx2#1071GHSA-f2fp-rgf2-35cp is a medium-severity (CVSS 5.9) CWE-407 vulnerability in httpx2. A fix is available for httpx2 — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-f2fp-rgf2-35cp.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-f2fp-rgf2-35cp by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 395,249 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
httpx2Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
HTTPX2's Server-Sent Events (SSE) parser repeatedly copied and rescanned buffered text when a server split one unterminated line across many response chunks. The total work grows quadratically with the length of the line. An attacker-controlled or compromised SSE endpoint can exploit this behavior to consume excessive client CPU.
Details
Before version 2.10.0, HTTPX2 combined the complete pending SSE line with each newly received chunk and then scanned the combined text for line separators. If an SSE server sends a long line as many small chunks without a line separator, every chunk causes all previously received text to be copied and scanned again. For n fixed-size chunks, this results in O(n²) processing.
The behavior affects both httpx2.Client.sse() and httpx2.AsyncClient.sse(). Other response APIs do not use the SSE parsing path.
Impact
Applications that consume SSE from an attacker-controlled or compromised endpoint can experience excessive CPU usage. A crafted stream can block a synchronous worker or the asynchronous event loop that is consuming it, degrading availability for other work in that process. Confidentiality and integrity are not affected.
Mitigation
Upgrade to HTTPX2 2.10.0 or later. SSE parsing now accumulates incomplete line fragments and combines them only when necessary, making processing linear in the amount of received data. HTTPX2 2.10.0 also limits buffered SSE events to 1 MiB by default through max_event_size.
If upgrading is not immediately possible, only consume SSE from trusted endpoints and enforce an external size or time budget on the stream.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | httpx2 | ≥ 2.5.0&&< 2.10.0 | 2.10.0pip install --upgrade 'httpx2==2.10.0' |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for httpx2, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update httpx2 to 2.10.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-f2fp-rgf2-35cp is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Moderate: A denial of service vulnerability exists in the HTTPX2 Python client library, affecting Red Hat products such as Lightspeed Core and Red Hat OpenShift AI. This flaw allows a remote attacker to consume excessive CPU resources by sending a specially crafted Server-Sent Events (SSE) stream, leading to resource…
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.Source: Red Hat security advisory for GHSA-f2fp-rgf2-35cp (CC BY 4.0)
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat AI Inference Server 3.5 | rhaii/vllm-gaudi-rhel9:1791427182 | RHSA-2026:82061 |
| Red Hat AI Inference Server 3.5 | rhaii/vllm-spyre-rhel9:1791818357 | RHSA-2026:82371 |
Frequently Asked Questions
Is GHSA-f2fp-rgf2-35cp in your dependencies?
Find it across PyPI, including transitive dependencies.