Improper Input Validation in httpx

CRITICAL 9.1CVE-2021-41945 · GHSA-h8pj-cxx2-jfg2 · PYSEC-2022-183 · Published 28/04/2022 · updated 09/07/2026

Package	Affected versions	Patched versions
httpx PyPI	`< 0.20.0< 0.23.0`	`0.20.00.23.0`
httpx encode	`< 0.23.0`	`0.23.0`

Description

Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in httpx.URL, httpx.Client and some functions using httpx.URL.copy_with.

NVD description

Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.

References

nvd.nist.gov/vuln/detail/CVE-2021-41945 · ADVISORY
encode/httpx · WEB
encode/httpx#2185 · WEB
encode/httpx#2185 · WEB
encode/httpx commit e9b0c85 · WEB
gist.github.com/lebr0nli/4edb76bbd3b5ff993cf44f2fbce5e571 · WEB
GitHub Advisory GHSA-h8pj-cxx2-jfg2 · ADVISORY
encode/httpx · PACKAGE
encode/httpx · WEB
encode/httpx release 0.23.0 · WEB
pypa/advisory-database · WEB
encode.com · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free