GitHub Advisoryadvisory · PyPI

GHSA-6hr6-w5qg-qmwg h2: Duplicate Host header could facilitate request smuggling

MEDIUM Published 2026-08-06 Modified 2026-08-06 Official page ↗
Aliases
CVE-2026-71554
Ecosystem
PyPI
Packages
h2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-444
Reviewed
2026-08-06

Affected packages

• PyPI h2: < 4.4.1 → fixed in 4.4.1

Description

Impact h2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). Patches Patched and fixed in v4.4.1 Workarounds Users of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. References Similar to the previously disclosed and fixed duplicate content-length issue.

Related

Alias · CVE (1)

  • CVE-2026-71554 h2 is a pure-Python implementation of a HTTP/2 protocol stack. vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References