id: PYSEC-2022-183
details: Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in
  `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.
affected:
- package:
    name: httpx
    ecosystem: PyPI
    purl: pkg:pypi/httpx
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.20.0
  versions:
  - 0.0.1
  - 0.10.0
  - 0.10.1
  - 0.11.0
  - 0.11.1
  - 0.12.0
  - 0.12.1
  - 0.13.0
  - 0.13.0.dev1
  - 0.13.0.dev2
  - 0.13.1
  - 0.13.2
  - 0.13.3
  - 0.13.dev0
  - 0.14.0
  - 0.14.1
  - 0.14.2
  - 0.14.3
  - 0.15.0
  - 0.15.1
  - 0.15.2
  - 0.15.3
  - 0.15.4
  - 0.15.5
  - 0.16.0
  - 0.16.1
  - 0.17.0
  - 0.17.1
  - 0.18.0
  - 0.18.1
  - 0.18.2
  - 0.19.0
  - 0.6.7
  - 0.6.8
  - 0.7.0
  - 0.7.1
  - 0.7.2
  - 0.7.3
  - 0.7.4
  - 0.7.5
  - 0.7.6
  - 0.7.7
  - 0.7.8
  - 0.8.0
  - 0.9.0
  - 0.9.1
  - 0.9.2
  - 0.9.3
  - 0.9.4
  - 0.9.5
references:
- type: WEB
  url: https://github.com/encode/httpx
- type: WEB
  url: https://github.com/encode/httpx/discussions/1831
- type: WEB
  url: https://gist.github.com/lebr0nli/4edb76bbd3b5ff993cf44f2fbce5e571
- type: WEB
  url: http://encode.com
- type: REPORT
  url: https://github.com/encode/httpx/issues/2184
- type: ADVISORY
  url: https://github.com/advisories/GHSA-h8pj-cxx2-jfg2
aliases:
- CVE-2021-41945
- GHSA-h8pj-cxx2-jfg2
modified: "2022-05-17T21:40:52.405453Z"
published: "2022-04-28T14:15:00Z"