The vulnerability occurs when httpx2's Request._prepare() automatically adds a body‑derived Content‑Length header while the caller already provides a Transfer‑Encoding header. The code treats the two framing headers independently rather than as mutually exclusive, resulting in requests that contain both headers. This dual framing can cause request smuggling or connection desynchronization in downstream proxies or intermediaries that disagree on which header takes precedence, potentially allowing attackers to inject unintended request boundaries into HTTP/1.1 traffic.

The affected vendor and product are pydantic’s Python HTTP client library httpx2, version 2.10.x and earlier. Applications or services built with pydantic's httpx2 before release 2.11.0 that perform outbound HTTP requests are at risk, as they may automatically generate conflicting framing headers.

The CVSS score of 5.6 indicates moderate severity; no EPSS score is published, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote control over the application’s request construction or supply of data that triggers the generation of both Content‑Length and Transfer‑Encoding headers, with downstream intermediaries that may accept the first header seen. The risk is moderate to high for exposed services that do not validate or normalize outgoing requests, particularly in environments where HTTP/1.1 proxies or gateways interpret framing headers inconsistently.