h2
Pure-Python HTTP/2 protocol implementation
View on Github
Activity
- Latest release
- 1mo ago
- Total releases
- 47
- Cadence
- ~10 days
- Last 12 months
- 2
Reach
- Stars
- 1.0k
Details
- License
- MIT
- First release
- Oct 15, 2015
| Version | Released | |
|---|---|---|
4.4.1
patch
| ||
4.4.0
minor
1 CVE
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev | ||
4.3.0
minor
1 CVE
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev | ||
4.2.0
minor
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
4.1.0
minor
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
4.0.0
major
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.2.0
minor
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.1.1
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.1.0
minor
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.0.1
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.6.2
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.5.4
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
3.0.0
major
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.6.1
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.5.3
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.4.4
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.6.0
minor
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.5.2
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.4.3
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.3.4
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.5.1
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.5.0
minor
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.4.2
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.3.3
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.2.7
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.4.1
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.3.2
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.2.6
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.4.0
minor
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.3.1
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.2.5
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.3.0
minor
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.2.4
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.1.5
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.2.3
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.1.4
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.2.2
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.2.1
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.2.0
minor
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.1.3
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.1.2
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.1.1
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.1.0
minor
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
2.0.0
major
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
1.1.1
patch
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
1.1.0
minor
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev | ||
1.0.0
initial
2 CVEs
CVE-2026-71554
PYSEC-2026-3628
GHSA-6hr6-w5qg-qmwg
Aug 10, 2026
h2: Duplicate Host header could facilitate request smuggling
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
Impacth2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). PatchesPatched and fixed in v4.4.1 WorkaroundsUsers of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ReferencesSimilar to the previously disclosed and fixed duplicate content-length issue. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 35 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
Fixed in
4.4.1
References
Updated Aug 10, 2026 · Source: OSV.dev
CVE-2025-57804
PYSEC-2026-1435
GHSA-847f-9342-265h
Jul 07, 2026
h2 allows HTTP Request Smuggling due to illegal characters in headers
Low
Network
Low
None
None
SummaryHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Affected versions
0.1.0
1.0.0
1.1.0
1.1.1
2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
+ 33 more Show less
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.6.0
2.6.1
2.6.2
3.0.0
3.0.1
3.1.0
3.1.1
3.2.0
4.0.0
4.1.0
4.2.0
Fixed in
4.3.0
References
Updated Jul 07, 2026 · Source: OSV.dev |