Skip to main content

Python h2 Library CVE-2026-71554

| EUVDEUVD-2026-54177 MEDIUM
HTTP Request/Response Smuggling (CWE-444)
2026-08-06 https://github.com/python-hyper/h2 GHSA-6hr6-w5qg-qmwg
Information Disclosure Red Hat Request Smuggling Suse
5.3
CVSS 3.1 · Vendor: https://github.com/python-hyper/h2
Share

Severity by source

Vendor (https://github.com/python-hyper/h2) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI
5.3 MEDIUM

Network-accessible with no auth; integrity impact (routing/cache manipulation) better represents smuggling than availability; no confidentiality or availability impact from the primitive itself.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (https://github.com/python-hyper/h2).

CVSS VectorVendor: https://github.com/python-hyper/h2

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 06, 2026 - 22:21 vuln.today
Analysis Generated
Aug 06, 2026 - 22:21 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 6,995 pypi packages depend on h2 (243 direct, 6,782 indirect)

Ecosystem-wide dependent count for version 4.4.1.

DescriptionCVE.org

Impact

h2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444).

Patches

Patched and fixed in v4.4.1

Workarounds

Users of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack.

References

Similar to the previously disclosed and fixed duplicate content-length issue.

AnalysisAI

Request smuggling primitive in h2 (pip/h2) versions 4.4.0 and below enables network-accessible attackers to craft HTTP/2 header blocks containing duplicate Host headers that the library forwards verbatim to consuming applications. When a consumer downgrades the HTTP/2 request to HTTP/1.1 - a common pattern in reverse proxy and gateway architectures - the resulting HTTP/1.1 request carries two Host header lines, violating RFC 7230 and creating an ambiguity that downstream servers may interpret differently, enabling cache poisoning, security control bypass, or session hijacking. No active exploitation confirmed (not in CISA KEV); no public exploit code identified at time of analysis; fix is available in v4.4.1.

Technical ContextAI

h2 is the canonical Python implementation of the HTTP/2 protocol, distributed as pip/h2 under the python-hyper organization. HTTP/2 transmits headers as HPACK-compressed binary blocks rather than plaintext; the h2 library is responsible for parsing these blocks and surfacing them to calling application code. CWE-444 (Inconsistent Interpretation of HTTP Requests) describes the root cause: h2 ≤4.4.0 did not enforce the HTTP/2 specification requirement that a header block contain at most one Host header, and forwarded all duplicates downstream. The vulnerability mirrors a prior duplicate content-length issue in the same library. The patch (commit 292a40829feefda98c8509dcdbbb4a57af9bd6a6) adds a ProtocolError in _validate_host_authority_header within src/h2/utilities.py that rejects header blocks containing more than one Host value before they reach consumer code. The affected CPE is pkg:pip/h2.

RemediationAI

Upgrade the pip/h2 package to version 4.4.1 or later; this version raises a ProtocolError and rejects any HTTP/2 header block containing multiple Host headers before the data reaches application code (patch commit 292a40829feefda98c8509dcdbbb4a57af9bd6a6, advisory GHSA-6hr6-w5qg-qmwg). Where an immediate upgrade is not possible, consuming application code should explicitly validate that each inbound request exposes exactly one Host header and reject or terminate requests that carry duplicates - however, the vendor notes that h2 provides best-effort sanity checks and the calling code bears final responsibility, so application-layer workarounds are fragile and should not substitute for upgrading. Teams should audit any reverse proxy or gateway components built on h2 that perform HTTP/2-to-HTTP/1.1 downgrading, as those are the deployments where the smuggling primitive can be realised; architectures that terminate HTTP/2 without any HTTP/1.1 downstream forwarding have reduced but non-zero exposure.

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2026-48710 MEDIUM POC
6.5
CVE-2021-33037 MEDIUM
5.3
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-71554 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy