External risk intelligence

Encode httpx Improper Input Validation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2021-41945

This is a vulnerability in a software library (httpx) used by developers to build HTTP clients. While it can be integrated into internet-facing applications, the library itself is a dependency used within custom code rather than a standalone service, product, or gateway that is inherently exposed to the public internet.

Encode Httpx

before 0.23.0

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability involves a flaw in how a popular Python HTTP client library handles certain inputs, potentially allowing for unauthorized access to sensitive information and system modifications. While the library is a component within applications, its widespread use means organizations should verify if their internally developed or third-party software utilizes this specific library and confirm their exposure.

Input validation flaw in Python HTTP client.
Affects many applications that use this library.
Confirm if your software is affected and review exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted input to an application that uses the vulnerable `httpx` library. Because there are no authentication or user interface requirements, an attacker can reach the vulnerable `httpx.URL` or related functions over the network, potentially leading to a denial-of-service or the execution of arbitrary code.

No authentication or user interaction needed.
Crafted input triggers improper validation.
Can lead to code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to manipulate how URLs are processed, potentially leading to unexpected behavior when handling network requests. This could impact system data or service behavior when the vulnerable `httpx` library is used to parse untrusted URLs.

System data integrity.
Malicious URL processing.
Service instability or misdirection.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the httpx library impacts applications that use it for HTTP client functionality. Application owners are responsible for assessing their use of this library, while platform and infrastructure teams may need to support remediation efforts. The initial step involves identifying all instances of the affected library, determining business criticality and external reachability, and then prioritizing mitigation based on potential impact.

Own by application developers.
Verify library usage and exposure.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the encode httpx library?

httpx is a widely used, feature-rich Python library that allows developers to send HTTP requests. It serves as a modern foundation for building web scrapers, API clients, and other services that need to communicate over the network. Because it is a library rather than a standalone application, it is embedded as a dependency within custom software or third-party tools to handle network connectivity.

What does improper input validation mean for CVE-2021-41945?

This vulnerability, classified as CWE-20, means the library fails to properly sanitize or verify data provided to it. In the context of CVE-2021-41945, specifically within httpx.URL and related functions, this weakness allows an attacker to supply crafted input that the library processes incorrectly. This flaw can lead to unintended consequences, such as the manipulation of network request destinations or unauthorized data access, as the library does not sufficiently restrict the input.

How is this vulnerability triggered?

The flaw is triggered when an application using an affected version of httpx processes malicious, specially crafted input through the vulnerable URL parsing functions. It does not require the attacker to have authentication credentials or user interaction. Importantly, this issue only occurs when the library is actively used to process untrusted or malformed URLs; it is not triggered by simply having the library installed in a project's environment.

Do I need to worry if my application is internal?

Halo Surface Signal notes that while this is a dependency rather than a standalone gateway, its risk depends on how your application uses it. If your internal application processes URLs provided by external, untrusted sources, it may be reachable. However, if the library is used only for strictly controlled internal traffic, the risk of external exploitation is significantly lower. Evaluate where your application ingest data to determine the actual exposure.

How do I respond to this vulnerability?

Your first step is to perform a dependency audit to identify all software projects in your environment that include httpx versions prior to 0.23.0. Once identified, prioritize these applications based on their exposure to untrusted input. The primary remediation is to update the httpx library to version 0.23.0 or later, which contains the necessary input validation fixes. Coordinate with your development teams to test and deploy this update within standard maintenance windows.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.