PyPI · httpx2
HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
HTTPX2 serializes the per-file Content-Type and custom headers supplied through the files= tuple API directly into the multipart/form-data body without validating custom header names or values. An attacker who can influence upload metadata passed to HTTPX2 can use CR or LF characters to terminate a multipart part header and inject additional part headers or end the part header block early.
The three-element file tuple accepts (filename, content, content_type), and the four-element form accepts (filename, content, content_type, headers). FileField.render_headers() interpolates the supplied header names and values between CRLF delimiters without validating them.
For example:
import httpx2
request = httpx2.Request(
"POST",
"https://example.com/upload",
headers={"Content-Type": "multipart/form-data; boundary=BOUNDARY"},
files={
"file": (
"safe.txt",
b"payload",
"text/plain\r\nX-Injected: true",
)
},
)
print(request.read().decode())
The generated body contains an attacker-injected part header:
--BOUNDARY
Content-Disposition: form-data; name="file"; filename="safe.txt"
Content-Type: text/plain
X-Injected: true
payload
--BOUNDARY--
The same issue affects names and values in the custom header mapping from the four-element tuple.
Field names and filenames are serialized through a separate escaping path and do not permit CRLF header injection.
Applications are affected when they pass attacker-controlled upload metadata into the per-file content_type or custom headers arguments. The receiving server interprets injected lines as genuine multipart part headers. Depending on how that server validates and processes uploads, this can alter part semantics or bypass checks based on part headers.
This does not split the outer HTTP request: the injected headers are contained within the multipart body. The concrete security impact therefore depends on the downstream multipart parser and application behavior.
Upgrade to HTTPX2 2.11.0 or later. Patched versions reject forbidden control characters in multipart part header names and values and raise ValueError before serializing the request.
If upgrading is not immediately possible, applications should validate custom multipart header names as HTTP field-name tokens. They should reject NUL, CR, LF, other C0 controls except horizontal tab, and DEL in per-file content types and custom header values before passing them to HTTPX2.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.