Weekly pysentry audit reports 4 vulnerabilities in the HTTP stack (httpx2/httpcore2) #33

New issue

Closed

opened 2026-09-13 08:56:41 +00:00 by agent-pi · 1 comment

agent-pi commented

2026-09-13 08:56:41 +00:00

Collaborator

nox -s pysentry is failing with 4 findings across 2 packages (2 HIGH, 2 MEDIUM), all fixable by upgrading:

PYSEC-2026-3844 (HIGH, CVSS 8.1) — httpcore2 2.3.0 (transitive, via httpx2): secure wss:// WebSocket traffic is sent without TLS when routed through a SOCKS proxy. A malicious proxy can read headers, cookies, query parameters, and message contents, and can impersonate the WebSocket server (CVE-2026-84381).
PYSEC-2026-3846 (HIGH, CVSS 7.5) — httpx2 2.3.0 (direct): streaming response decompression does not bound peak memory. A 64 KiB compressed chunk can inflate ~1000x (~64 MiB) per read, causing memory pressure or OOM on attacker-influenced responses (CVE-2026-84382).
PYSEC-2026-3848 (MEDIUM, CVSS 5.3) — httpx2 2.3.0 (direct): multipart part header injection — CR/LF in per-file content_type or custom headers from the files= tuple API are serialized unvalidated into the body (CVE-2026-84379).
PYSEC-2026-3849 (MEDIUM) — httpx2 2.3.0 (direct): a caller-supplied Transfer-Encoding header can be combined with an auto-generated Content-Length, producing ambiguous framing that enables request smuggling via intermediaries.

Upstream fix versions: httpx2 ≥ 2.12.0 (covers all three httpx2 advisories), httpcore2 ≥ 2.10.0.

`nox -s pysentry` is failing with 4 findings across 2 packages (2 HIGH, 2 MEDIUM), all fixable by upgrading: - **PYSEC-2026-3844** (HIGH, CVSS 8.1) — `httpcore2` 2.3.0 (transitive, via httpx2): secure `wss://` WebSocket traffic is sent **without TLS** when routed through a SOCKS proxy. A malicious proxy can read headers, cookies, query parameters, and message contents, and can impersonate the WebSocket server (CVE-2026-84381). - **PYSEC-2026-3846** (HIGH, CVSS 7.5) — `httpx2` 2.3.0 (direct): streaming response decompression does not bound peak memory. A 64 KiB compressed chunk can inflate ~1000x (~64 MiB) per read, causing memory pressure or OOM on attacker-influenced responses (CVE-2026-84382). - **PYSEC-2026-3848** (MEDIUM, CVSS 5.3) — `httpx2` 2.3.0 (direct): multipart part header injection — CR/LF in per-file `content_type` or custom headers from the `files=` tuple API are serialized unvalidated into the body (CVE-2026-84379). - **PYSEC-2026-3849** (MEDIUM) — `httpx2` 2.3.0 (direct): a caller-supplied `Transfer-Encoding` header can be combined with an auto-generated `Content-Length`, producing ambiguous framing that enables request smuggling via intermediaries. Upstream fix versions: httpx2 ≥ 2.12.0 (covers all three httpx2 advisories), httpcore2 ≥ 2.10.0.

agent-pi commented

2026-09-13 08:56:51 +00:00

Author

Collaborator

Findings from exploration

httpx2 is a direct dependency pinned ~=2.3 in pyproject.toml; httpcore2 enters the tree only through it.
All three httpx2 advisories are fixed in httpx2 2.12.0. The SOCKS/wss advisory (PYSEC-2026-3844) needs httpcore2 ≥ 2.10.0 — upgrading httpx2 may pull that in itself if 2.12.0 constrains httpcore2 accordingly; this needs verification after re-locking.
pytest-httpx2~=1.0 must remain compatible with httpx2 2.12 — the test suite will confirm.

Plan of attack

Bump the direct dependency httpx2 to ~=2.12, re-lock, and check which httpcore2 version resolves. If it stays below 2.10.0, add "httpcore2>=2.10.0" to [tool.uv] constraint-dependencies (alphabetical, comment citing PYSEC-2026-3844).
Regenerate pylock.toml in the same commit as the dependency change.
Verify nox -s pysentry is green, then full DoD: ruff format --check ., ruff check ., ty check ., complexipy ., nox -s pytest.
Update Release-Notes.md (taibai thread — security patches are user-facing).

Branch: fix/issue-33-bump-httpx2-security

Commits:

:arrow_up: bump: httpx2 to ~=2.12 to address PYSEC-2026-3846/3848/3849
(:wrench: constraint commit for httpcore2, only if still needed)

PR: opened via Forgejo API targeting main with Closes #33, then /skill:ci-watch.

**Findings from exploration** - `httpx2` is a direct dependency pinned `~=2.3` in `pyproject.toml`; `httpcore2` enters the tree only through it. - All three httpx2 advisories are fixed in httpx2 2.12.0. The SOCKS/`wss` advisory (PYSEC-2026-3844) needs httpcore2 ≥ 2.10.0 — upgrading httpx2 may pull that in itself if 2.12.0 constrains httpcore2 accordingly; this needs verification after re-locking. - `pytest-httpx2~=1.0` must remain compatible with httpx2 2.12 — the test suite will confirm. **Plan of attack** 1. Bump the direct dependency `httpx2` to `~=2.12`, re-lock, and check which `httpcore2` version resolves. If it stays below 2.10.0, add `"httpcore2>=2.10.0"` to `[tool.uv] constraint-dependencies` (alphabetical, comment citing PYSEC-2026-3844). 2. Regenerate `pylock.toml` in the same commit as the dependency change. 3. Verify `nox -s pysentry` is green, then full DoD: `ruff format --check .`, `ruff check .`, `ty check .`, `complexipy .`, `nox -s pytest`. 4. Update `Release-Notes.md` (taibai thread — security patches are user-facing). **Branch:** `fix/issue-33-bump-httpx2-security` **Commits:** - `:arrow_up: bump: httpx2 to ~=2.12 to address PYSEC-2026-3846/3848/3849` - (`:wrench:` constraint commit for httpcore2, only if still needed) **PR:** opened via Forgejo API targeting `main` with `Closes #33`, then `/skill:ci-watch`.

agent-pi referenced this issue from a commit

2026-09-13 09:00:28 +00:00

:arrow_up: bump: httpx2 to ~=2.12 to address PYSEC-2026-3844/3846/3848/3849

agent-pi referenced this issue from a pull request that will close it,

2026-09-13 09:00:39 +00:00

Bump httpx2 to 2.12 to resolve four HTTP stack security advisories #34