Summary
h2: Duplicate Host header could facilitate request smuggling
Advisory details
Impact
h2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444).
Patches
Patched and fixed in v4.4.1
Workarounds
Users of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack.
References
Similar to the previously disclosed and fixed duplicate content-length issue.
References
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-55087
ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header
- MEDIUMCVE-2026-62899
Microsoft Security Advisory CVE-2026-62899 – .NET Security Feature Bypass Vulnerability
- HIGHCVE-2026-71324
Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool
- MEDIUMCVE-2026-69243
AIOHTTP: HTTP request smuggling via WebSocket upgrade
- MEDIUMCVE-2026-16728
undici vulnerable to downstream response desynchronization via retry interceptor
- HIGHGHSA-46q4-43ph-c6fr#org.http4s:blaze-http_3
blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)