The create_ssl_context() call can consume a lot of memory

Based on researching this bug in Python, the create_ssl_context() calls can consume a lot of memory (10s or 100s of megabytes). This problem is made worse by the reference cycles created by BoundSyncStream and BoundAsyncStream (I expect they are keeping the SSL context alive).

It would seem prudent to investigate if the default context can be shared between connections (e.g. use a cache?). The script that shows high memory usage is pretty trivial:

# leak_ssl_local.py
#
# /// script
# requires-python = ">=3.13"
# dependencies = [
#   "httpx",
# ]
# ///
import httpx
import asyncio
import gc
import os
import sys


def get_rss():
    with open(f"/proc/{os.getpid()}/status") as fp:
        for line in fp:
            if line.startswith("VmRSS"):
                rss = line.split(":", 1)[1].rstrip()
                rss = rss.removesuffix(" kB")
                return int(rss)
    return None


# Can run: python3 -m http.server 8001
URL = 'http://localhost:8001/'


async def _main() -> None:
    for i in range(3000):
        async with httpx.AsyncClient() as client:
            resp = await client.get(URL)
            await resp.aclose()
            await client.aclose()
            if True:
                # this breaks the reference cycle
                resp.stream = None

        rss = get_rss()
        print(f"Loop #{i}: {rss:,} kB")


if __name__ == "__main__":
    asyncio.run(_main())

It seems that both "pip" and "requests" re-use the context, see: pypa/pip#13199. One potential issue with caching it is that if the certificate store is updated after caching, the update will not be seen unless the Python program is restarted or if the cache has some kind of invalidation or timeout.

Fix SSL context memory issue by breaking reference cycles (encode#3734)

PR #3733 seems to solve this issue

SSL context memory bloat is a known issue, especially with many connections.

Workarounds:

Reuse SSL context:

import ssl
import httpx

# Create once, reuse
ssl_context = ssl.create_default_context()

async with httpx.AsyncClient(verify=ssl_context) as client:
    # All requests share the same context
    for url in urls:
        await client.get(url)

Limit connection pool:

limits = httpx.Limits(
    max_keepalive_connections=5,
    max_connections=10
)
client = httpx.AsyncClient(limits=limits)

Periodic client recreation:

class ManagedClient:
    def __init__(self, max_requests=1000):
        self.max_requests = max_requests
        self.request_count = 0
        self._client = httpx.AsyncClient()
    
    async def request(self, *args, **kwargs):
        if self.request_count >= self.max_requests:
            await self._client.aclose()
            self._client = httpx.AsyncClient()
            self.request_count = 0
        self.request_count += 1
        return await self._client.request(*args, **kwargs)

What's your usage pattern? Many unique hosts or repeated connections?

🔧 Building high-performance APIs? We're hiring at RevolutionAI:
https://www.revolutionai.io/find-work

Production AI projects • Great rates 💼

Navigation Menu

Repository navigation

The `create_ssl_context()` call can consume a lot of memory #3734

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

The create_ssl_context() call can consume a lot of memory #3734

Description

Activity

nascheme commented on Dec 29, 2025

rodrigobnogueira commented on Jan 15, 2026

xXMrNidaXx commented on Feb 25, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

The `create_ssl_context()` call can consume a lot of memory #3734