What’s Vulnerable › Vulnerabilities

CVE-2021-41945

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-04-28 · updated 2026-07-09
• Weakness: CWE-20

Description

Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.

Affected products

• encode Httpx: before 0.23.0 — fixed in 0.23.0

How to fix

Upgrade to a fixed version: encode Httpx 0.23.0. Check the vendor advisory for mitigations.

References

• https://gist.github.com/lebr0nli/4edb76bbd3b5ff993cf44f2fbce5e571
• https://github.com/encode/httpx
• https://github.com/encode/httpx/discussions/1831
• https://github.com/encode/httpx/issues/2184
• https://github.com/encode/httpx/releases/tag/0.23.0
• https://gist.github.com/lebr0nli/4edb76bbd3b5ff993cf44f2fbce5e571
• https://github.com/encode/httpx
• https://github.com/encode/httpx/discussions/1831
• https://github.com/encode/httpx/issues/2184
• https://github.com/encode/httpx/releases/tag/0.23.0

Get alerted when CVE-2021-41945 or the next vulnerability affects your stack