HTTPX2, a Python HTTP client library, mistakenly inflates each gzip, deflate, brotli, or zstd compressed network chunk before providing pieces to the application. A small 64 KiB compressed chunk can expand to roughly 64 MiB in a single allocation, leading to severe memory pressure or out‑of‑memory termination even when the application streams responses. The weakness is a classic decompression amplification flaw, classified as CWE‑409, which can allow an attacker who can serve crafted compressed data to trigger denial of service on any Python program using the affected library.

All installations of httpx2 older than version 2.12.0 are affected. Any Python project that imports httpx2 and receives responses from external servers may be impacted if it uses the default decompression handlers provided in the library.

The CVSS score of 7.5 reflects the high impact of resource exhaustion. EPSS information is unavailable, so the current likelihood of exploitation cannot be quantified; the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote because the encrypted data originates from an external HTTP server or an attacker‑controlled network source. An attacker can send a compressed payload that triggers excessive memory allocation in the client, draining memory and potentially crashing the process.