Threats affecting pkg:brew/bump-my-version

HTTPX2 versions from 1.4.0 up to but not including 1.5.1_1 can automatically add a Content-Length header to requests that already include a Transfer-Encoding header. This results in HTTP/1.1 requests containing both headers, violating HTTP framing rules and potentially enabling request smuggling or connection desynchronization attacks when intermediaries interpret these headers differently. The issue is fixed in HTTPX2 version 1.5.1_1.

HTTPX2 versions from 1.4.0 up to but not including 1.5.1_1 improperly serialize per-file Content-Type and custom headers in multipart/form-data requests without validating for CR or LF characters. This allows an attacker controlling upload metadata to inject additional multipart part headers by terminating headers early. The impact depends on how the receiving server processes multipart parts, potentially altering part semantics or bypassing header-based checks. The issue does not affect the outer HTTP request structure. A fix is available in HTTPX2 version 1.5.1_1 and later.

HTTPX2 versions before 2.10.0 have a Server-Sent Events (SSE) parser vulnerability where processing a long SSE line split across many small chunks causes CPU usage to grow quadratically. This can lead to denial of service by exhausting client CPU resources when consuming SSE from attacker-controlled or compromised endpoints. The issue affects both synchronous and asynchronous SSE client APIs. Upgrading to HTTPX2 2.10.0 or later mitigates the issue by improving parsing efficiency and limiting buffered event size.

HTTPX2 versions prior to 1.5.1_1 decompress streaming response bodies fully per network read, causing large intermediate memory allocations. This decompression amplification can lead to high memory usage or out-of-memory termination when processing malicious compressed responses from untrusted servers. The issue affects compressed responses using gzip, deflate, Brotli, or Zstandard encodings. The vulnerability is fixed in HTTPX2 version 1.5.1_1 by implementing incremental decompression with bounded buffers.

HTTPX2 versions 2.6.0 through 2.9.1 and underlying httpcore2 releases before 2.10.0 do not initiate TLS for secure WebSocket (wss://) connections routed through SOCKS5 proxies. This results in the WebSocket handshake and subsequent frames being sent in plaintext through the proxy, exposing sensitive data such as authorization headers, cookies, and application messages. An attacker controlling or observing the SOCKS proxy path can intercept or modify this traffic, impersonate the WebSocket server, and inject malicious messages. The issue is fixed in HTTPX2 and httpcore2 version 2.10.0 and later.

The pydantic-settings library's NestedSecretsSettingsSource component improperly follows symbolic links inside a configured secrets directory that point outside this directory, allowing local files outside the intended secrets directory to be read into application settings. This behavior bypasses the configured maximum size limit for secrets directories, potentially leading to unintended local file disclosure and resource exhaustion via cyclic symlinks. The vulnerability requires the ability to place symlinks inside the secrets directory and is not remotely exploitable by itself. It affects versions from 1.2.5 up to but not including 1.4.1_1. A fix is available in version 1.4.1_1.