AIKIDO-2026-213916
httpx2 is vulnerable to HTTP Request Smuggling
56
Medium Risk
This Affects:
httpx2TL;DR
When a request carries a caller-supplied Transfer-Encoding header together with a known-size body, the request preparation logic uses a default-setting helper that adds a Content-Length header without treating the two framing mechanisms as mutually exclusive. The resulting request advertises both Content-Length and Transfer-Encoding, creating ambiguous HTTP/1.1 message boundaries. Intermediaries that interpret the conflicting headers differently can enable request smuggling or connection desynchronization. The fix treats the two headers as mutually exclusive when applying auto-generated framing.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application sends requests with a caller-supplied Transfer-Encoding header together with a known-size body over HTTP/1.1.
Background info
httpx2 is vulnerable to HTTP Request Smuggling in versions 0.0.1 - 2.10.0.
How to fix this
Upgrade the httpx2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant