GitHub Advisoryadvisory · PyPI

GHSA-847f-9342-265h h2 allows HTTP Request Smuggling due to illegal characters in headers

MEDIUM Published 2025-08-25 Modified 2025-11-03 Official page ↗
Aliases
CVE-2025-57804
Ecosystem
PyPI
Packages
h2
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Weaknesses
CWE-93
Reviewed
2025-08-25

Affected packages

• PyPI h2: < 4.3.0 → fixed in 4.3.0

Description

Summary HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.

Related

Alias · CVE (1)

  • CVE-2025-57804 h2 is a pure-Python implementation of a HTTP/2 protocol stack. vulnerability

Weakness · CWE (1)

  • CWE-93 Improper Neutralization of CRLF Sequences weakness

References