CVE-2026-71554

Received Received - Intake

HTTP/2 Request Smuggling in h2 Library

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-71554

Affected Vendors & Products

Vendor	Product	Version / Range
python	h2	to 4.4.0 (inc)
python	h2	4.4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

This vulnerability affects the h2 library, a Python HTTP/2 protocol implementation. Versions up to 4.4.0 incorrectly accept multiple Host headers in a single request. When downgraded to HTTP/1.1, this creates a request smuggling vulnerability where two Host headers are forwarded to the application.

Impact Analysis

An attacker could exploit this to send crafted requests that bypass security controls or manipulate application behavior. This may lead to unauthorized access, data leaks, or service disruption. The impact depends on how the application processes Host headers.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Compliance may be compromised if exploited.

Mitigation Strategies

Upgrade the h2 library to version 4.4.1 or later to address the vulnerability. Monitor HTTP/2 traffic for multiple Host headers in requests, especially during downgrades to HTTP/1.1.

Hi! I’m here to help you understand CVE-2026-71554. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70