The vulnerability resides in the Server‑Sent Events parser of HTTPX2. When an attacker‑controlled or compromised SSE endpoint sends a single very long, unterminated line split across many chunks, the _SSELineDecoder repeatedly copies and rescans the buffered text, causing the total work to grow quadratically with the line length. This excessive CPU processing can block a synchronous worker or an asynchronous event loop, effectively denying service to legitimate requests. The weaknesses, listed as CWE-407 and CWE-606, allow an adversary to exhaust a client’s processing resources without affecting confidentiality or integrity of data.

The affected product is pydantic’s HTTPX2 client library. Versions from 2.5.0 up to but not including 2.10.0 are vulnerable. The issue was resolved in release 2.10.0, so any installation using a prior version is impacted.

The CVSS v3.1 score of 5.9 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit this flaw by controlling an SSE endpoint that the HTTPX2 client communicates with, or by compromising a third‑party endpoint that the client connects to. No elevated privileges are required; the condition is simply that the client processes SSE data. Given the moderate CVSS score and the absence of widespread exploitation data, the risk is considered moderate but still significant for systems where CPU usage is a critical resource.