Every CVE Search/ Get API key

CVE-2026-71554

h2: Duplicate Host header could facilitate request smuggling

5.3 MediumPublic exploitFix available

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.42%Up 0.1 points since Aug 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

h2: Duplicate Host header could facilitate request smuggling

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.

Record
CVE-2026-71554
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-444
Updated
2026-11-02
EUVDEUVD-2026-54177 5.3

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.

Record
EUVD-2026-54177
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-6hr6-w5qg-qmwg 5.3

h2: Duplicate Host header could facilitate request smuggling

Impact

h2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444).

Patches

Patched and fixed in v4.4.1

Workarounds

Users of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack.

References

Similar to the previously disclosed and fixed duplicate content-length issue.

Record
GHSA-6hr6-w5qg-qmwg
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-444
Updated
2026-11-02
NVD 5.3

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.

Record
CVE-2026-71554
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-444
Updated
2026-11-02
OSVBELL-CVE-2026-71554 5.3
Record
BELL-CVE-2026-71554
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSV 5.3

h2: Duplicate Host header could facilitate request smuggling

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.

Record
CVE-2026-71554
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-444
Updated
2026-11-02
Show 10 moreShow less
OSVDEBIAN-CVE-2026-71554 5.3

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.

Record
DEBIAN-CVE-2026-71554
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVGHSA-6hr6-w5qg-qmwg 5.3

h2: Duplicate Host header could facilitate request smuggling

Impact

h2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444).

Patches

Patched and fixed in v4.4.1

Workarounds

Users of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack.

References

Similar to the previously disclosed and fixed duplicate content-length issue.

Record
GHSA-6hr6-w5qg-qmwg
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-444
Updated
2026-11-02
OSVPYSEC-2026-3628 5.3

h2: Duplicate Host header could facilitate request smuggling

Impact

h2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444).

Patches

Patched and fixed in v4.4.1

Workarounds

Users of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack.

References

Similar to the previously disclosed and fixed duplicate content-length issue.

Record
PYSEC-2026-3628
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-71554 5.3

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.

Record
UBUNTU-CVE-2026-71554
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVMGASA-2026-0409 No score

Updated python-h2 packages fix a security vulnerability

Duplicate Host header facilitate request smuggling. (CVE-2026-71554)

Record
MGASA-2026-0409
Updated
2026-11-02
OSVopenSUSE-SU-2026:11523-1 No score

python313-h2-4.4.1-1.1 on GA media

These are all security issues fixed in the python313-h2-4.4.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11523-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21693-1 No score

Security update for python-h2

This update for python-h2 fixes the following issue:

  • CVE-2026-71554: duplicate Host headers are accepted and forwarded to consuming applications, which can lead to request smuggling (bsc#1274386).
Record
openSUSE-SU-2026:21693-1
Updated
2026-11-02
OSVSUSE-SU-2026:23563-1 No score

Security update for python-h2

This update for python-h2 fixes the following issue:

  • CVE-2026-71554: duplicate Host headers are accepted and forwarded to consuming applications, which can lead to request smuggling (bsc#1274386).
Record
SUSE-SU-2026:23563-1
Updated
2026-11-02
OSVSUSE-SU-2026:3970-1 No score

Security update for python-h2

This update for python-h2 fixes the following issue:

  • CVE-2026-71554: duplicate Host headers are accepted and forwarded to consuming applications, which can lead to request smuggling (bsc#1274386).
Record
SUSE-SU-2026:3970-1
Updated
2026-11-02
OSVSUSE-SU-2026:3972-1 No score

Security update for python-h2

This update for python-h2 fixes the following issue:

  • CVE-2026-71554: duplicate Host headers are accepted and forwarded to consuming applications, which can lead to request smuggling (bsc#1274386).
Record
SUSE-SU-2026:3972-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
h2
PyPI
 through 4.4.0
4.4.1
py3-h2
Alpaquita:23
 4.1.0-r1 up to 4.1.0-r2
4.1.0-r2
py3-h2
Alpaquita:25
 4.1.0-r3 up to 4.1.0-r4
4.1.0-r4
py3-h2
Alpaquita:stream
 4.1.0-r0 up to 4.1.0-r6
4.1.0-r6
python-h2
Debian:12
 All versions, plus listed versions
4.1.0-44.2.0-14.3.0-14.3.0-2
 None known
python-h2
Debian:13
 All versions, plus listed versions
4.2.0-14.3.0-14.3.0-2
 None known
python-h2
Debian:14
 All versions, plus listed versions
4.2.0-14.3.0-14.3.0-2
 None known
h2
PyPI
 before 4.4.1, plus listed versions
0.1.01.0.01.1.01.1.12.0.0
Show 42 moreShow less
2.1.02.1.12.1.22.1.32.1.42.1.52.2.02.2.12.2.22.2.32.2.42.2.52.2.62.2.72.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.32.4.42.5.02.5.12.5.22.5.32.5.42.6.02.6.12.6.23.0.03.0.13.1.03.1.13.2.04.0.04.1.04.2.04.3.04.4.0
4.4.1
python-h2
Mageia:10
 before 4.3.0-1.1.mga10
4.3.0-1.1.mga10
python-h2
Mageia:9
 before 4.1.0-2.1.mga9
4.1.0-2.1.mga9
Show 12 moreShow less
Affected packages
PackageAffectedFixed
python-h2
SUSE:Linux Enterprise Server 16.0
 before 4.2.0-160000.4.1
4.2.0-160000.4.1
python-h2
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 4.2.0-160000.4.1
4.2.0-160000.4.1
python-h2
SUSE:Linux Enterprise Module for Python 3 15 SP7
 before 4.1.0-150400.8.9.1
4.1.0-150400.8.9.1
python-h2
SUSE:Linux Enterprise Module for Server Applications 15 SP7
 before 3.2.0-150200.3.8.1
3.2.0-150200.3.8.1
python-h2
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.0.1-13.0.1-23.0.1-3
 None known
python-h2
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.0.1-43.0.1-4.1ubuntu13.0.1-53.1.1-1
 None known
python-h2
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.0.0-34.1.0-3ubuntu1
 None known
python-h2
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.1.0-4
 None known
python-h2
Ubuntu:26.10
 All versions, plus listed versions
4.3.0-14.3.0-2
 None known
python-h2
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.2.0-14.3.0-1
 None known
python-h2
openSUSE:Tumbleweed
 before 4.4.1-1.1
4.4.1-1.1
python-h2
openSUSE:Leap 16.0
 before 4.2.0-160000.4.1
4.2.0-160000.4.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubSunandM/poc-h2-CVE-2026-715542026-08-07

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-71554 is a medium vulnerability (CVSS 5.3) in Python-hyper H2, published August 6, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in h2 4.4.1.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open