CVE-2026-71554CWE-444

CVE-2026-71554

Medium · published August 7, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
35.0
In the wild
Unconfirmed
What it is

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00418 · 35.0th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2026-08-07T02:18Z
References (2)
https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6 · [email protected]https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg · [email protected]
EPSS history
Timeline
  • 06 AUG 21:46Z
    h2: Duplicate Host header could facilitate request smuggling
    cvelistv5