CVE-2025-57804: h2 allows HTTP Request Smuggling due to illegal characters in headers

Description

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.

Exploitation

Is it being used?

Exploit prediction (EPSS)1.8% · higher than 78% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

H2

h2 · python-hyper

< 4.3.0 · source: vendor