h2: Duplicate Host header could facilitate request smuggling
30Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3
from disclosure to weapon1 days
Published on NVDAug 6
1st PoC+1d
exploitation probability
—
observed exploitation
nono source reports it
1 public exploit(s)
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
python-hyper · h2public PoCs found — 1
githubgithub.com/SunandM/poc-h2-CVE-2026-71554★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.