CVE-2026-71554: python-hyper h2 request smuggling via duplicate Host headers

Executive brief

The h2 library, a popular Python implementation of the HTTP/2 protocol, contains a flaw in how it handles web request headers. An attacker can send a specially crafted request with multiple 'Host' headers that the library incorrectly accepts and passes along. This can lead to 'request smuggling,' where an attacker can bypass security controls or interfere with other users' web traffic, potentially causing service disruptions.

Technical details

The h2 library (<= 4.4.0) fails to validate that an HTTP/2 request header block contains only a single 'Host' header. When these requests are forwarded to a consuming application that performs a protocol downgrade from HTTP/2 to HTTP/1.1, the resulting message contains duplicate Host header lines. This inconsistency in header interpretation is a request smuggling primitive (CWE-444). An unauthenticated remote attacker can exploit this to desynchronize proxy/server chains. The issue is fixed in version 4.4.1 by ensuring only one Host header is accepted.

Affected products

• python-hyper h2 <= 4.4.0

Timeline

• 2026-08-03: disclosed
• 2026-08-06: advisory
• 2026-08-06: patched: Fixed in version 4.4.1

References

• https://api.github.com/users/SunandM
• https://github.com/SunandM
• https://api.github.com/users/SunandM/gists%7B/gist_id%7D
• https://api.github.com/users/SunandM/repos
• https://avatars.githubusercontent.com/u/106249159?v=4
• https://api.github.com/users/SunandM/events%7B/privacy%7D