CVE-2026-71554
published 2026-08-06CVE-2026-71554: h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.42%
35.1th percentile
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-24 | ee-supported-rhel8 | — | — |
| ansible-automation-platform-24 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-24 | platform-resource-runner-rhel8 | — | — |
| ansible-automation-platform-25 | ee-supported-rhel8 | — | — |
| ansible-automation-platform-25 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-25 | platform-resource-runner-rhel8 | — | — |
| ansible-automation-platform-26 | ee-supported-rhel9 | — | — |
| ansible-automation-platform-27 | ee-supported-rhel9 | — | — |
| h2database | h2 | >= 0 < 4.4.1 | 4.4.1 |
| python-hyper | h2 | < 4.4.1 | 4.4.1 |
| rhai | guidellm-rhel9 | — | — |
| rhmtc | openshift-migration-hook-runner-rhel8 | — | — |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-llama-stack-core-rhel9 | — | — |
| rhoai | odh-ogx-core-rhel9 | — | — |
| rhoso | openstack-tempest-all-rhel9 | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
h2: h2: Request smuggling due to duplicate Host headers
vendor_redhat·2026-08-06·CVSS 5.3
CVE-2026-71554 [MEDIUM] CWE-444 h2: h2: Request smuggling due to duplicate Host headers
h2: h2: Request smuggling due to duplicate Host headers
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.
A flaw was found in h2, a Python library for HTTP/2. This vulnerability allows a remote attacker to perform request smuggling. The library incorrectly processes HTTP/2 requests that contain more than one Host header. When these requests are downgraded to HTTP/1.1 by a consuming application, the duplicate Host headers can be exploited
VulDB
python-hyper h2 up to 4.4.0 request smuggling
vuldb·2026-08-07·CVSS 5.3
CVE-2026-71554 [MEDIUM] python-hyper h2 up to 4.4.0 request smuggling
A vulnerability was found in python-hyper h2 up to 4.4.0 and classified as problematic. The impacted element is an unknown function. Executing a manipulation can lead to http request smuggling.
This vulnerability is handled as CVE-2026-71554. The attack can be executed remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
h2: Duplicate Host header could facilitate request smuggling
ghsa·2026-08-06
CVE-2026-71554 [MEDIUM] CWE-444 h2: Duplicate Host header could facilitate request smuggling
h2: Duplicate Host header could facilitate request smuggling
### Impact
h2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444).
### Patches
Patched and fixed in v4.4.1
### Workarounds
Users of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack.
### References
Similar to the previously disclosed and fixed duplicate content-length issue.
No detection rules found.
No public exploits indexed.
2026-08-06
Published