CVE-2026-71554

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71554
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71554.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-71554
Aliases
Downstream
Related
Published
2026-08-06T21:46:43.057Z
Modified
2026-08-08T11:36:19.051357033Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
h2: Duplicate Host header could facilitate request smuggling
Details

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71554.json",
    "cwe_ids": [
        "CWE-444"
    ]
}
References

Affected packages

Git / github.com/python-hyper/h2

Affected ranges

Type
GIT
Repo
https://github.com/python-hyper/h2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
292a40829feefda98c8509dcdbbb4a57af9bd6a6
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.4.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.1.1
v2.*
v2.0.0
v2.1.0
v2.2.0
v2.3.0
v2.4.0
v2.5.0
v2.6.0
v3.*
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v4.*
v4.0.0
v4.1.0
v4.2.0
v4.3.0
v4.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71554.json"