CVE-2026-71554

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6
https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) h2 es una implementación puramente en Python de una pila del protocolo HTTP/2. Las versiones hasta la 4.4.0 inclusive aceptan bloques de encabezado de solicitud que contienen más de un encabezado Host, y reenvían cada encabezado Host a la aplicación consumidora. Cuando el consumidor degrada HTTP/2 a HTTP/1.1, la solicitud resultante lleva dos líneas de encabezado Host, lo que proporciona una primitiva de contrabando de solicitudes. Este problema se corrige en la versión 4.4.1.

Information

Published : 2026-08-06 22:18

Updated : 2026-10-24 15:10

NVD link : CVE-2026-71554

Mitre link : CVE-2026-71554

CVE.ORG link : CVE-2026-71554

JSON object : View

Products Affected

No product.

CWE

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

{"id": "CVE-2026-71554", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71554", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-08T02:49:21.263516Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "python-hyper", "product": "h2", "versions": [{"status": "affected", "version": "< 4.4.1"}]}]}], "published": "2026-08-06T22:18:32.403", "references": [{"url": "https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6", "source": "security-advisories@github.com"}, {"url": "https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1."}, {"lang": "es", "value": "h2 es una implementaci\u00f3n puramente en Python de una pila del protocolo HTTP/2. Las versiones hasta la 4.4.0 inclusive aceptan bloques de encabezado de solicitud que contienen m\u00e1s de un encabezado Host, y reenv\u00edan cada encabezado Host a la aplicaci\u00f3n consumidora. Cuando el consumidor degrada HTTP/2 a HTTP/1.1, la solicitud resultante lleva dos l\u00edneas de encabezado Host, lo que proporciona una primitiva de contrabando de solicitudes. Este problema se corrige en la versi\u00f3n 4.4.1."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "security-advisories@github.com"}