{"id":"CVE-2025-57804","aliases":["BELL-CVE-2025-57804","DEBIAN-CVE-2025-57804","DLA-4290-1","EUVD-2025-28631","GHSA-847f-9342-265h","OESA-2025-2250","PYSEC-2026-1435","ROOT-APP-PYPI-CVE-2025-57804","SUSE-SU-2025:03199-1","SUSE-SU-2025:03273-1","SUSE-SU-2026:20187-1","UBUNTU-CVE-2025-57804","openSUSE-SU-2025:15496-1","openSUSE-SU-2026:20122-1"],"status":"published","title":"h2 allows HTTP Request Smuggling due to illegal characters in headers","description":"h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01883,"percentile":0.79638,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-93"],"published":"2025-08-25T20:44:43Z","modified":"2026-10-28T02:30:43Z","fixes":[{"ecosystem":"PyPI","package":"h2","fixed_in":["4.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"python-h2","fixed_in":["4.3.0-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"python-h2","fixed_in":["4.0.0-3+deb11u1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"python-h2","fixed_in":["4.1.0-3.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-h2","fixed_in":["4.1.0-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"python-h2","fixed_in":["4.1.0-3.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-h2","fixed_in":["4.0.0-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"python-h2","fixed_in":["4.0.0-3.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"python-h2","fixed_in":["4.0.0-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"rootio-h2","fixed_in":["4.2.0+root.io.1","4.1.0+root.io.1","4.1.0+root.io.2","4.2.0+root.io.2"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"h2","fixed_in":["4.1.0+aikido.2","4.2.0+aikido.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-h2","fixed_in":["4.1.0-150400.8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-h2","fixed_in":["4.1.0-150400.8.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python-h2","fixed_in":["4.1.0-150400.8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"python-h2","fixed_in":["3.2.0-150200.3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"python-h2","fixed_in":["3.2.0-150200.3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-h2","fixed_in":["4.2.0-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-h2","fixed_in":["4.2.0-160000.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-h2","fixed_in":["4.3.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"python-h2","fixed_in":["4.2.0-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"py3-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"py3-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0-4","4.2.0-1","4.3.0-1","4.3.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.0-1","4.3.0-1","4.3.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-1"}]}],"versions":["4.2.0-1"]},{"source":"osv","ecosystem":"Debian:11","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-3+deb11u1"}]}],"versions":["4.0.0-3"]},{"source":"osv","ecosystem":"PyPI","package":"h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0"}]}],"versions":["0.1.0","1.0.0","1.1.0","1.1.1","2.0.0","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.6.0","2.6.1","2.6.2","3.0.0","3.0.1","3.1.0","3.1.1","3.2.0","4.0.0","4.1.0","4.2.0"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-3.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-3.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-3.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0"}]}],"versions":["0.1.0","1.0.0","1.1.0","1.1.1","2.0.0","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.6.0","2.6.1","2.6.2","3.0.0","3.0.1","3.1.0","3.1.1","3.2.0","4.0.0","4.1.0","4.2.0"]},{"source":"osv","ecosystem":"Root:PyPI","package":"rootio-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0+root.io.1"},{"fixed":"4.1.0+root.io.1"},{"fixed":"4.1.0+root.io.2"},{"fixed":"4.2.0+root.io.2"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0+aikido.2"},{"fixed":"4.2.0+aikido.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-150400.8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-150400.8.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-150400.8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-150200.3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-150200.3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.1-1","3.0.1-2","3.0.1-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.1-4","3.0.1-4.1ubuntu1","3.0.1-5","3.1.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.0-3","4.1.0-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0-4","4.2.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.0-1","4.3.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-160000.3.1"}]}]}],"products":[{"vendor":"python-hyper","product":"h2"}],"references":[{"url":"https://github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/python-hyper/h2/commit/035e9899f95e3709af098f578bfc3cd302298e3a","tags":["x_refsource_MISC","fix","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00004.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57804","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-847f-9342-265h","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-57804","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57804.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-57804","tags":["advisory"]},{"url":"https://github.com/python-hyper/h2","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2250","tags":["advisory"]},{"url":"https://pypi.org/project/h2","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503199-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248737","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-57804","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503273-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620187-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-57804","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-57804","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-57804","title":"h2 allows HTTP Request Smuggling due to illegal characters in headers","description":"h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.","status":"published","published":"2025-08-25T21:04:52.642Z","modified":"2025-11-03T18:13:44.839Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:32:34.773122Z"}],"euvd":[{"id":"EUVD-2025-28631","description":"h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.","status":"published","published":"2025-08-25T21:04:52Z","modified":"2025-11-03T18:13:44Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:49:34.635725Z"}],"ghsa":[{"id":"GHSA-847f-9342-265h","title":"h2 allows HTTP Request Smuggling due to illegal characters in headers","description":"### Summary\n\nHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.","status":"published","published":"2025-08-25T20:44:43Z","modified":"2025-11-03T21:34:26Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:39:04.350802Z"}],"nvd":[{"id":"CVE-2025-57804","description":"h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.","status":"published","published":"2025-08-25T21:15:37.983Z","modified":"2026-06-17T09:43:28.05Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T14:11:25.826804Z"}],"osv":[{"id":"CVE-2025-57804","title":"h2 allows HTTP Request Smuggling due to illegal characters in headers","description":"h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.","status":"published","published":"2025-08-25T21:04:52.642Z","modified":"2026-10-28T02:30:43.761945495Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:44:51.190588Z"},{"id":"DEBIAN-CVE-2025-57804","description":"h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.","status":"published","published":"2025-08-25T21:15:37.983Z","modified":"2026-09-01T20:05:55.057392564Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"GHSA-847f-9342-265h","title":"h2 allows HTTP Request Smuggling due to illegal characters in headers","description":"### Summary\n\nHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.","status":"published","published":"2025-08-25T20:44:43Z","modified":"2026-09-10T03:50:26.965133425Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"OESA-2025-2250","title":"python-h2 security update","description":"This repository contains a pure-Python implementation of a HTTP/2 protocol stack. It is written from the ground up to be embeddable in whatever program you choose to use, ensuring that you can speak HTTP/2 regardless of your programming paradigm.\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in python-hyper h2 up to 4.2.x (Programming Language Software) and classified as problematic.Using CWE to declare the problem leads to CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.Impacted is integrity.Upgrading to version 4.3.0 eliminates this vulnerability. Applying the patch 035e9899f95e3709af098f578bfc3cd302298e3a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-57804)","status":"published","published":"2025-09-12T11:09:19Z","modified":"2026-08-18T01:19:09.637611345Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"PYSEC-2026-1435","title":"h2 allows HTTP Request Smuggling due to illegal characters in headers","description":"### Summary\n\nHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.","status":"published","published":"2026-07-07T16:03:01.951354Z","modified":"2026-07-07T17:47:39.182570446Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"UBUNTU-CVE-2025-57804","description":"h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.","status":"published","published":"2025-08-25T21:15:00Z","modified":"2026-05-20T16:23:37.25261056Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"BELL-CVE-2025-57804","status":"published","published":"2025-08-28T06:11:56.762366Z","modified":"2026-01-26T09:40:33.081193Z","updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"DLA-4290-1","title":"python-h2 - security update","status":"published","published":"2025-09-02T00:00:00Z","modified":"2026-03-09T02:10:49.072294Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"openSUSE-SU-2025:15496-1","title":"python311-h2-4.3.0-1.1 on GA media","description":"These are all security issues fixed in the python311-h2-4.3.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-27T00:00:00Z","modified":"2026-03-23T04:53:51.398794Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:20122-1","title":"Security update for python-h2","description":"This update for python-h2 fixes the following issues:\n\n- CVE-2025-57804: Fixed HTTP Request Smuggling due to illegal characters in headers (bsc#1248737)\n","status":"published","published":"2026-01-28T15:52:29Z","modified":"2026-03-23T04:54:45.05116Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"ROOT-APP-PYPI-CVE-2025-57804","title":"CVE-2025-57804 in rootio-h2 - Patched by Root","description":"Root has patched CVE-2025-57804 in the rootio-h2 package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-06-03T14:52:05Z","modified":"2026-06-03T19:30:13.668374382Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"SUSE-SU-2025:03199-1","title":"Security update for python-h2","description":"This update for python-h2 fixes the following issues:\n\n- CVE-2025-57804: Fixed HTTP Request Smuggling due to illegal characters in headers (bsc#1248737)\n","status":"published","published":"2025-09-12T12:19:41Z","modified":"2026-03-23T04:49:55.23088Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03273-1","title":"Security update for python-h2","description":"This update for python-h2 fixes the following issues:\n\n- CVE-2025-57804: Fixed HTTP Request Smuggling due to illegal characters in headers (bsc#1248737) \n","status":"published","published":"2025-09-19T12:12:03Z","modified":"2026-03-23T04:48:46.088457Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2026:20187-1","title":"Security update for python-h2","description":"This update for python-h2 fixes the following issues:\n\n- CVE-2025-57804: Fixed HTTP Request Smuggling due to illegal characters in headers (bsc#1248737)\n","status":"published","published":"2026-01-28T15:47:48Z","modified":"2026-03-23T04:52:41.857166Z","updated_at":"2026-11-02T15:54:01.610851Z"}]}}