## https://sploitus.com/exploit?id=12C31FF5-21A7-5670-974E-22BD695A853E
# CVE-2026-71554 - h2 Duplicate Host Header Request Smuggling Primitive
> This is my first CVE. I've released this PoC to document the finding and help others understand and reproduce it.
**CVE:** CVE-2026-71554
**GHSA:** GHSA-6hr6-w5qg-qmwg
**Affected:** h2 1:
raise ProtocolError("Request header block has multiple Host headers.")
Commit: https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6
---
## Credit
Found and reported by Sunand Mohan (https://github.com/SunandM)