CVE-2026-71554

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.

Affected products

H2

CVSS 3.1

5.3 MEDIUM

EPSS

0.3% (25th percentile)

Weakness

CWE-444

NVD status

Received

Published

2026-08-06