PT-2022-5665 · Encode Oss+2 · Httpx+2

Lebr0Nlio · Published 2022-04-28 · Updated 2025-01-18 · CVE-2021-41945

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Encode OSS httpx versions < 0.23.0 Encode OSS httpx version <=1.0.0.beta0

Description The issue is related to insufficient input validation in the httpx.URL and httpx.Client components, as well as in some functions that utilize httpx.URL.copy with. This could potentially allow a remote attacker to bypass existing security restrictions.

Recommendations For Encode OSS httpx versions < 0.23.0, update to version 0.23.0 or later to resolve the issue. For Encode OSS httpx version <=1.0.0.beta0, update to a version later than 1.0.0.beta0 to resolve the issue. As a temporary workaround, consider restricting the use of httpx.URL and httpx.Client until a patch is available. Avoid using functions that utilize httpx.URL.copy with in the affected API endpoints until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2022-2246

ALT-PU-2023-5210

BDU:2022-07059

CVE-2021-41945

GHSA-H8PJ-CXX2-JFG2

OPENSUSE-SU-2024:12041-1

OPENSUSE-SU-2025:14664-1

PYSEC-2022-183

Affected Products

Alt Linux

Debian

Httpx

References · 27

• 🔥 https://github.com/encode/httpx/discussions/1831 · Exploit
• 🔥 https://github.com/encode/httpx/issues/2184 · Exploit
• 🔥 https://gist.github.com/lebr0nli/4edb76bbd3b5ff993cf44f2fbce5e571 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2021-41945 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-41945 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14664-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-183 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41945 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41945 · Security Note
• https://bdu.fstec.ru/vul/2022-07059 · Security Note
• http://encode.com · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-41945 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h8pj-cxx2-jfg2 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-41945 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-41945 · Vendor Advisory