Vulnerabilities CVE-2026-71554

CVE-2026-71554

Medium

Open

TLP:CLEAR

h2: Duplicate Host header could facilitate request smuggling

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.

Details

CVSS Score: 5.3
EPSS Score ⓘ: 0.33%

25.2th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Confidence: 90%
Published: Aug 6, 2026
Last Modified: Aug 8, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.