CVE-2026-71554: h2: Duplicate Host header could facilitate request smuggling
Impact h2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444).
Patches Patched and fixed in v4.4.1
Workarounds Users of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack.
References Similar to the previously disclosed and fixed duplicate content-length issue.
Other sources
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/h2to a version that resolves this vulnerability.Fixed in 4.4.1 - Upgrade
Upgrade
h2to a version that resolves this vulnerability.Fixed in 4.4.1 - Compensating control
If your application uses h2 and may downgrade HTTP/2 to HTTP/1.1, ensure HTTP semantics best practices so that request header blocks do not contain more than one Host header (duplicate Host headers can provide a request smuggling primitive when downgraded to HTTP/1.1).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71554?
The severity of CVE-2026-71554 is rated as medium with a score of 5.3.
What impact does CVE-2026-71554 have on software?
CVE-2026-71554 affects h2 versions up to 4.4.0, allowing multiple Host headers which can lead to request smuggling.
How do I fix CVE-2026-71554?
To fix CVE-2026-71554, upgrade the h2 library to a version that is above 4.4.0.
Which software is affected by CVE-2026-71554?
CVE-2026-71554 affects the h2 library used by Python's pip.
What is a request smuggling primitive in the context of CVE-2026-71554?
In the context of CVE-2026-71554, a request smuggling primitive is created when the application forwards multiple Host headers, potentially allowing attackers to manipulate request handling.