Medium severity · published Aug 6, 2026
CVE-2026-71554
h2: Duplicate Host header could facilitate request smuggling
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
H2
h2 · python-hyper
< 4.4.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-71554
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-71554
github.com
https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6
github.com
https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg
More from h2
6.9
CVE-2025-57804
h2 allows HTTP Request Smuggling due to illegal characters in headers