p PatchFirst

CVE-2026-71554

CVE-2026-71554 · h2: Duplicate Host header could facilitate request smuggling

This page contains facts from public vulnerability sources. Check the original advisory before updating.

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.

CVSS 5.3 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • h2

    Versions
    • < 4.4.1: Affected

    No fix published

  • python-h2 Debian:12

    Versions
    • 4.1.0-4
    • 4.2.0-1
    • 4.3.0-1
    • 4.3.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-h2 Debian:13

    Versions
    • 4.2.0-1
    • 4.3.0-1
    • 4.3.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-h2 Debian:14

    Versions
    • 4.2.0-1
    • 4.3.0-1
    • 4.3.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • h2 PyPI

    Versions
    • 0.1.0
    • 1.0.0
    • 1.1.0
    • 1.1.1
    • 2.0.0
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 2.1.4
    • 2.1.5
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.2.3
    • 2.2.4
    • 2.2.5
    • 2.2.6
    • 2.2.7
    • 2.3.0
    • 2.3.1
    • 2.3.2
    • 2.3.3
    • 2.3.4
    • 2.4.0
    • 2.4.1
    • 2.4.2
    • 2.4.3
    • 2.4.4
    • 2.5.0
    • 2.5.1
    • 2.5.2
    • 2.5.3
    • 2.5.4
    • 2.6.0
    • 2.6.1
    • 2.6.2
    • 3.0.0
    • 3.0.1
    • 3.1.0
    • 3.1.1
    • 3.2.0
    • 4.0.0
    • 4.1.0
    • 4.2.0
    • 4.3.0
    • 4.4.0
    Affected ranges
    • ECOSYSTEM: < 4.4.1

    Update to 4.4.1

  • python-h2 Ubuntu:18.04:LTS

    Versions
    • 3.0.1-1
    • 3.0.1-2
    • 3.0.1-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-h2 Ubuntu:20.04:LTS

    Versions
    • 3.0.1-4
    • 3.0.1-4.1ubuntu1
    • 3.0.1-5
    • 3.1.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-h2 Ubuntu:22.04:LTS

    Versions
    • 4.0.0-3
    • 4.1.0-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-h2 Ubuntu:24.04:LTS

    Versions
    • 4.1.0-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-h2 Ubuntu:26.10

    Versions
    • 4.3.0-1
    • 4.3.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-h2 Ubuntu:26.04:LTS

    Versions
    • 4.2.0-1
    • 4.3.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →