THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-f2fp-rgf2-35cp (medium) — HTTPX2: Quadratic SSE line buffering can cause CPU denial of service

[GHSA] GHSA-f2fp-rgf2-35cp (medium) — HTTPX2: Quadratic SSE line buffering can cause CPU denial of service

medgithub_advisoriesPublished 2026-09-08

GHSA-f2fp-rgf2-35cp Severity: medium CVE: CVE-2026-84378

HTTPX2: Quadratic SSE line buffering can cause CPU denial of service

### Summary

HTTPX2's Server-Sent Events (SSE) parser repeatedly copied and rescanned buffered text when a server split one unterminated line across many response chunks. The total work grows quadratically with the length of the line. An attacker-controlled or compromised

Indicators of compromise

CVE-2026-84378cve

Original source: https://github.com/advisories/GHSA-f2fp-rgf2-35cp