Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
encode/httpx
master @ b5addb6
7
Fixes
1
CVEs
CRITICAL
Peak severity
Highlights
Information Disclosure: 4 prior fixes. Scrutinize any change in this area.
httpx/client.py: most-fixed (3 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Information Disclosure: The client request loop is highly prone to leaking sensitive state, such as custom Host headers, authentication headers, or cookies, during cross-origin redirects if redirect and authorization layers are decoupled or incorrectly ordered.
Information Disclosure: Parsing and reconstructing URLs with embedded credentials can lead to the transmission of plaintext credentials in headers like Host or Proxy-Authorization if serialization logic does not explicitly strip authority credentials.
Auth Bypass: Ambient credentials from environment configurations (e.g., .netrc) may mistakenly override explicitly supplied request headers, causing unauthorized requests or session pollution.