CVE-2026-71554
h2: Duplicate Host header could facilitate request smuggling
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.
| CWE | CWE-444 |
| Vendor | python-hyper |
| Product | h2 |
| Published | Aug 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for python-hyper h2
Be the first to know when new medium vulnerabilities affecting python-hyper h2 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Affected Versions
python-hyper / h2
< 4.4.1