CVE-2025-57804
h2 allows HTTP Request Smuggling due to illegal characters in headers
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
h2 allows HTTP Request Smuggling due to illegal characters in headers
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.
- Record
CVE-2025-57804- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-93
- Updated
- 2026-11-02
EUVDEUVD-2025-28631
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.
- Record
EUVD-2025-28631- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-847f-9342-265h
h2 allows HTTP Request Smuggling due to illegal characters in headers
Summary
HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.
- Record
GHSA-847f-9342-265h- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-93
- Updated
- 2026-11-02
NVD
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.
- Record
CVE-2025-57804- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-93
- Updated
- 2026-11-02
OSV
h2 allows HTTP Request Smuggling due to illegal characters in headers
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.
- Record
CVE-2025-57804- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-93
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-57804
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.
- Record
DEBIAN-CVE-2025-57804- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
Show 10 moreShow less
OSVGHSA-847f-9342-265h
h2 allows HTTP Request Smuggling due to illegal characters in headers
Summary
HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.
- Record
GHSA-847f-9342-265h- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-93
- Updated
- 2026-11-02
OSVOESA-2025-2250
python-h2 security update
This repository contains a pure-Python implementation of a HTTP/2 protocol stack. It is written from the ground up to be embeddable in whatever program you choose to use, ensuring that you can speak HTTP/2 regardless of your programming paradigm.
Security Fix(es):
A vulnerability was found in python-hyper h2 up to 4.2.x (Programming Language Software) and classified as problematic.Using CWE to declare the problem leads to CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.Impacted is integrity.Upgrading to version 4.3.0 eliminates this vulnerability. Applying the patch 035e9899f95e3709af098f578bfc3cd302298e3a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-57804)
- Record
OESA-2025-2250- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVPYSEC-2026-1435
h2 allows HTTP Request Smuggling due to illegal characters in headers
Summary
HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.
- Record
PYSEC-2026-1435- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-57804
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.
- Record
UBUNTU-CVE-2025-57804- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15496-1 No score
python311-h2-4.3.0-1.1 on GA media
These are all security issues fixed in the python311-h2-4.3.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15496-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20122-1 No score
Security update for python-h2
This update for python-h2 fixes the following issues:
- CVE-2025-57804: Fixed HTTP Request Smuggling due to illegal characters in headers (bsc#1248737)
- Record
openSUSE-SU-2026:20122-1- Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2025-57804 No score
CVE-2025-57804 in rootio-h2 - Patched by Root
Root has patched CVE-2025-57804 in the rootio-h2 package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2025-57804- Updated
- 2026-11-02
OSVSUSE-SU-2025:03199-1 No score
Security update for python-h2
This update for python-h2 fixes the following issues:
- CVE-2025-57804: Fixed HTTP Request Smuggling due to illegal characters in headers (bsc#1248737)
- Record
SUSE-SU-2025:03199-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:03273-1 No score
Security update for python-h2
This update for python-h2 fixes the following issues:
- CVE-2025-57804: Fixed HTTP Request Smuggling due to illegal characters in headers (bsc#1248737)
- Record
SUSE-SU-2025:03273-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20187-1 No score
Security update for python-h2
This update for python-h2 fixes the following issues:
- CVE-2025-57804: Fixed HTTP Request Smuggling due to illegal characters in headers (bsc#1248737)
- Record
SUSE-SU-2026:20187-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
h2PyPI |
before 4.3.0 | 4.3.0 |
py3-h2Alpaquita:23 |
4.1.0-r1 and later | None known |
py3-h2Alpaquita:25 |
4.1.0-r3 and later | None known |
py3-h2Alpaquita:stream |
4.1.0-r0 and later | None known |
python-h2Debian:12 |
All versions, plus listed versions 4.1.0-44.2.0-14.3.0-14.3.0-2 |
None known |
python-h2Debian:13 |
All versions, plus listed versions 4.2.0-14.3.0-14.3.0-2 |
None known |
python-h2Debian:14 |
before 4.3.0-1, plus listed versions 4.2.0-1 |
4.3.0-1 |
python-h2Debian:11 |
before 4.0.0-3+deb11u1, plus listed versions 4.0.0-3 |
4.0.0-3+deb11u1 |
h2PyPI |
before 4.3.0, plus listed versions 0.1.01.0.01.1.01.1.12.0.0 Show 40 moreShow less2.1.02.1.12.1.22.1.32.1.42.1.52.2.02.2.12.2.22.2.32.2.42.2.52.2.62.2.72.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.32.4.42.5.02.5.12.5.22.5.32.5.42.6.02.6.12.6.23.0.03.0.13.1.03.1.13.2.04.0.04.1.04.2.0 |
4.3.0 |
python-h2openEuler:24.03-LTS |
before 4.1.0-3.oe2403sp2 | 4.1.0-3.oe2403sp2 |
Show 22 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-h2openEuler:24.03-LTS-SP1 |
before 4.1.0-3.oe2403sp1 | 4.1.0-3.oe2403sp1 |
python-h2openEuler:24.03-LTS-SP2 |
before 4.1.0-3.oe2403sp2 | 4.1.0-3.oe2403sp2 |
python-h2openEuler:20.03-LTS-SP4 |
before 4.0.0-2.oe2003sp4 | 4.0.0-2.oe2003sp4 |
python-h2openEuler:22.03-LTS-SP3 |
before 4.0.0-3.oe2203sp3 | 4.0.0-3.oe2203sp3 |
python-h2openEuler:22.03-LTS-SP4 |
before 4.0.0-3.oe2203sp4 | 4.0.0-3.oe2203sp4 |
rootio-h2Root:PyPI |
before 4.2.0+root.io.1 | 4.2.0+root.io.14.1.0+root.io.14.1.0+root.io.24.2.0+root.io.2 |
h2Root:PyPI |
before 4.1.0+aikido.2 | 4.1.0+aikido.24.2.0+aikido.2 |
python-h2SUSE:Linux Enterprise Module for Python 3 15 SP6 |
before 4.1.0-150400.8.6.1 | 4.1.0-150400.8.6.1 |
python-h2SUSE:Linux Enterprise Module for Python 3 15 SP7 |
before 4.1.0-150400.8.6.1 | 4.1.0-150400.8.6.1 |
python-h2openSUSE:Leap 15.6 |
before 4.1.0-150400.8.6.1 | 4.1.0-150400.8.6.1 |
python-h2SUSE:Linux Enterprise Module for Server Applications 15 SP6 |
before 3.2.0-150200.3.5.1 | 3.2.0-150200.3.5.1 |
python-h2SUSE:Linux Enterprise Module for Server Applications 15 SP7 |
before 3.2.0-150200.3.5.1 | 3.2.0-150200.3.5.1 |
python-h2SUSE:Linux Enterprise Server 16.0 |
before 4.2.0-160000.3.1 | 4.2.0-160000.3.1 |
python-h2SUSE:Linux Enterprise Server for SAP applications 16.0 |
before 4.2.0-160000.3.1 | 4.2.0-160000.3.1 |
python-h2Ubuntu:18.04:LTS |
All versions, plus listed versions 3.0.1-13.0.1-23.0.1-3 |
None known |
python-h2Ubuntu:20.04:LTS |
All versions, plus listed versions 3.0.1-43.0.1-4.1ubuntu13.0.1-53.1.1-1 |
None known |
python-h2Ubuntu:22.04:LTS |
All versions, plus listed versions 4.0.0-34.1.0-3ubuntu1 |
None known |
python-h2Ubuntu:24.04:LTS |
All versions, plus listed versions 4.1.0-4 |
None known |
python-h2Ubuntu:25.10 |
All versions, plus listed versions 4.1.0-44.2.0-1 |
None known |
python-h2Ubuntu:26.04:LTS |
All versions, plus listed versions 4.2.0-14.3.0-1 |
None known |
python-h2openSUSE:Tumbleweed |
before 4.3.0-1.1 | 4.3.0-1.1 |
python-h2openSUSE:Leap 16.0 |
before 4.2.0-160000.3.1 | 4.2.0-160000.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-57804 is a medium vulnerability (CVSS 6.9) in Python-hyper H2, published August 25, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in h2 4.3.0.
References
github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h
lists.debian.org/debian-lts-announce/2025/09/msg00004.html
nvd.nist.gov/vuln/detail/CVE-2025-57804
docs.bell-sw.com/security/cves/CVE-2025-57804
Show 12 moreShow less
security-tracker.debian.org/tracker/CVE-2025-57804
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-2250
pypi.org/project/h2
suse.com/support/update/announcement/2025/suse-su-202503199-1
bugzilla.suse.com/1248737
ubuntu.com/security/CVE-2025-57804
cve.org/CVERecord?id=CVE-2025-57804