Vulnerability · Published Aug 6, 2026 · Assigned by GitHub_M
CVE-2026-71554h2: Duplicate Host header could facilitate request smuggling
Medium 5.3
In plain English
A medium-severity security flaw in h2 from python-hyper. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-h2 | no fix listed | DEBIAN-CVE-2026-71554 |
| Debian:13 | python-h2 | no fix listed | DEBIAN-CVE-2026-71554 |
| Debian:14 | python-h2 | no fix listed | DEBIAN-CVE-2026-71554 |
| PyPI | h2 | 4.4.1 | GHSA-6hr6-w5qg-qmwg |
| PyPI | h2 | 4.4.1 | PYSEC-2026-3628 |
| Ubuntu:22.04:LTS | python-h2 | no fix listed | UBUNTU-CVE-2026-71554 |
| Ubuntu:24.04:LTS | python-h2 | no fix listed | UBUNTU-CVE-2026-71554 |
| Ubuntu:26.04:LTS | python-h2 | no fix listed | UBUNTU-CVE-2026-71554 |
| Ubuntu:26.10 | python-h2 | no fix listed | UBUNTU-CVE-2026-71554 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| python-hyper | h2 | < 4.4.1 |
Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L