{"id":"CVE-2026-71554","aliases":["BELL-CVE-2026-71554","DEBIAN-CVE-2026-71554","EUVD-2026-54177","GHSA-6hr6-w5qg-qmwg","MGASA-2026-0409","PYSEC-2026-3628","SUSE-SU-2026:23563-1","SUSE-SU-2026:3970-1","SUSE-SU-2026:3972-1","UBUNTU-CVE-2026-71554","openSUSE-SU-2026:11523-1","openSUSE-SU-2026:21693-1"],"status":"published","title":"h2: Duplicate Host header could facilitate request smuggling","description":"h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00418,"percentile":0.36559,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-444"],"published":"2026-08-06T21:46:43Z","modified":"2026-10-28T02:30:44Z","exploits":[{"source":"pocgithub","id":"SunandM/poc-h2-CVE-2026-71554","title":"SunandM/poc-h2-CVE-2026-71554","date":"2026-08-07","url":"https://github.com/SunandM/poc-h2-CVE-2026-71554"}],"fixes":[{"ecosystem":"PyPI","package":"h2","fixed_in":["4.4.1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpaquita:23","package":"py3-h2","fixed_in":["4.1.0-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"py3-h2","fixed_in":["4.1.0-r4"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"py3-h2","fixed_in":["4.1.0-r6"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"python-h2","fixed_in":["4.3.0-1.1.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"python-h2","fixed_in":["4.1.0-2.1.mga9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-h2","fixed_in":["4.2.0-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-h2","fixed_in":["4.2.0-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-h2","fixed_in":["4.1.0-150400.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"python-h2","fixed_in":["3.2.0-150200.3.8.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-h2","fixed_in":["4.4.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"python-h2","fixed_in":["4.2.0-160000.4.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.4.0"},{"fixed":"4.4.1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"py3-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0-r1"},{"fixed":"4.1.0-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"py3-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0-r3"},{"fixed":"4.1.0-r4"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0-r0"},{"fixed":"4.1.0-r6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0-4","4.2.0-1","4.3.0-1","4.3.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.0-1","4.3.0-1","4.3.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.0-1","4.3.0-1","4.3.0-2"]},{"source":"osv","ecosystem":"PyPI","package":"h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1"}]}],"versions":["0.1.0","1.0.0","1.1.0","1.1.1","2.0.0","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.6.0","2.6.1","2.6.2","3.0.0","3.0.1","3.1.0","3.1.1","3.2.0","4.0.0","4.1.0","4.2.0","4.3.0","4.4.0"]},{"source":"osv","ecosystem":"Mageia:10","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-1.1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-2.1.mga9"}]}]},{"source":"osv","ecosystem":"PyPI","package":"h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1"}]}],"versions":["0.1.0","1.0.0","1.1.0","1.1.1","2.0.0","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.6.0","2.6.1","2.6.2","3.0.0","3.0.1","3.1.0","3.1.1","3.2.0","4.0.0","4.1.0","4.2.0","4.3.0","4.4.0"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-150400.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-150200.3.8.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.1-1","3.0.1-2","3.0.1-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.1-4","3.0.1-4.1ubuntu1","3.0.1-5","3.1.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.0-3","4.1.0-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.0-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.0-1","4.3.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.0-1","4.3.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-160000.4.1"}]}]}],"products":[{"vendor":"python-hyper","product":"h2"}],"references":[{"url":"https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/advisories/GHSA-6hr6-w5qg-qmwg","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-71554","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71554.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71554","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-71554","tags":["advisory"]},{"url":"https://github.com/python-hyper/h2","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0409.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36188","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/IDTJHCXCD2JELR2ZHWETBBYC3OYTW7QH/","tags":["web"]},{"url":"https://pypi.org/project/h2","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623563-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1274386","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71554","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263970-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263972-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-71554","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71554","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-71554","title":"h2: Duplicate Host header could facilitate request smuggling","description":"h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.","status":"published","published":"2026-08-06T21:46:43.057Z","modified":"2026-08-08T02:49:30.505Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-54177","description":"h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.","status":"published","published":"2026-08-06T21:46:43Z","modified":"2026-08-08T02:49:30Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:02:06.573967Z"}],"ghsa":[{"id":"GHSA-6hr6-w5qg-qmwg","title":"h2: Duplicate Host header could facilitate request smuggling","description":"### Impact\nh2 \u003c=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444).\n\n### Patches\nPatched and fixed in v4.4.1\n\n### Workarounds\nUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack.\n\n### References\nSimilar to the previously disclosed and fixed duplicate content-length issue.","status":"published","published":"2026-08-06T21:53:41Z","modified":"2026-08-06T21:53:43Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:40:57.999375Z"}],"nvd":[{"id":"CVE-2026-71554","description":"h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.","status":"published","published":"2026-08-06T22:18:32.403Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:12:35.386166Z"}],"osv":[{"id":"BELL-CVE-2026-71554","status":"published","published":"2026-08-10T06:05:46.977198Z","modified":"2026-08-14T07:15:15.149787557Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:25.50888Z"},{"id":"CVE-2026-71554","title":"h2: Duplicate Host header could facilitate request smuggling","description":"h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.","status":"published","published":"2026-08-06T21:46:43.057Z","modified":"2026-10-28T02:30:44.161829838Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:45:15.511448Z"},{"id":"DEBIAN-CVE-2026-71554","description":"h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.","status":"published","published":"2026-08-06T22:18:32.403Z","modified":"2026-10-25T09:47:36.588733388Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:46:02.094661Z"},{"id":"GHSA-6hr6-w5qg-qmwg","title":"h2: Duplicate Host header could facilitate request smuggling","description":"### Impact\nh2 \u003c=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444).\n\n### Patches\nPatched and fixed in v4.4.1\n\n### Workarounds\nUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack.\n\n### References\nSimilar to the previously disclosed and fixed duplicate content-length issue.","status":"published","published":"2026-08-06T21:53:41Z","modified":"2026-09-10T03:51:13.136510577Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"PYSEC-2026-3628","title":"h2: Duplicate Host header could facilitate request smuggling","description":"### Impact\nh2 \u003c=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444).\n\n### Patches\nPatched and fixed in v4.4.1\n\n### Workarounds\nUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack.\n\n### References\nSimilar to the previously disclosed and fixed duplicate content-length issue.","status":"published","published":"2026-08-10T10:43:51.432758Z","modified":"2026-08-10T11:30:11.413688625Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:56.847083Z"},{"id":"UBUNTU-CVE-2026-71554","description":"h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.","status":"published","published":"2026-08-06T22:18:00Z","modified":"2026-10-17T13:00:46.970858848Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:57:03.035847Z"},{"id":"MGASA-2026-0409","title":"Updated python-h2 packages fix a security vulnerability","description":"Duplicate Host header facilitate request smuggling. (CVE-2026-71554)\n","status":"published","published":"2026-09-16T15:40:01Z","modified":"2026-09-16T15:45:03.443905599Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11523-1","title":"python313-h2-4.4.1-1.1 on GA media","description":"These are all security issues fixed in the python313-h2-4.4.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-15T00:00:00Z","modified":"2026-08-16T11:45:05.559881959Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21693-1","title":"Security update for python-h2","description":"This update for python-h2 fixes the following issue:\n\n- CVE-2026-71554: duplicate `Host` headers are accepted and forwarded to consuming applications, which can lead to\n  request smuggling (bsc#1274386).\n","status":"published","published":"2026-08-30T14:33:33Z","modified":"2026-08-31T18:15:04.199681229Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23563-1","title":"Security update for python-h2","description":"This update for python-h2 fixes the following issue:\n\n- CVE-2026-71554: duplicate `Host` headers are accepted and forwarded to consuming applications, which can lead to\n  request smuggling (bsc#1274386).\n","status":"published","published":"2026-08-30T14:34:16Z","modified":"2026-09-29T18:23:08.595796118Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3970-1","title":"Security update for python-h2","description":"This update for python-h2 fixes the following issue:\n\n- CVE-2026-71554: duplicate `Host` headers are accepted and forwarded to consuming applications, which can lead to\n  request smuggling (bsc#1274386).\n","status":"published","published":"2026-09-04T08:20:19Z","modified":"2026-09-13T18:23:12.642583402Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3972-1","title":"Security update for python-h2","description":"This update for python-h2 fixes the following issue:\n\n- CVE-2026-71554: duplicate `Host` headers are accepted and forwarded to consuming applications, which can lead to\n  request smuggling (bsc#1274386).\n","status":"published","published":"2026-09-04T08:20:44Z","modified":"2026-09-13T18:23:12.672921246Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}