CVE-2026-71554

Summary

h2: Duplicate Host header could facilitate request smuggling

Severity

medium

CVSS

5.3

EPSS

0.4% (p36)

CWE

CWE-444

Also known as

GHSA-6hr6-w5qg-qmwg

Published

2026-08-06

Updated

2026-08-06

Advisory details

Impact

h2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444).

Patches

Patched and fixed in v4.4.1

Workarounds

Users of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack.

References

Similar to the previously disclosed and fixed duplicate content-length issue.

References

• https://github.com/advisories/GHSA-6hr6-w5qg-qmwg
• https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg
• https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6

Related advisories

• CVE-2025-57804 — medium · PyPI/h2
• GHSA-q6cp-qfwq-4gcv — medium · crates.io/h2
• GHSA-8r5v-vm4m-4g25 — medium · crates.io/h2
• CVE-2023-26964 — medium · crates.io/h2
• GHSA-cxf3-9h37-7rr8#github.com/labstack/echo/v5 — critical · Go/github.com/labstack/echo/v5
• GHSA-cxf3-9h37-7rr8#github.com/labstack/echo/v4 — critical · Go/github.com/labstack/echo/v4
• CVE-2026-88092 — critical · NuGet/Microsoft.AspNetCore.App.Runtime.linux-arm
• CVE-2026-70188 — critical · NuGet/Microsoft.AspNetCore.App.Runtime.linux-arm

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity