debian/python-h2 vulnerabilities

Latest debian/python-h2 CVEs

Newest publication first

1. CVE-2026-71554 h2: Duplicate Host header could facilitate request smuggling

   Published 2026-08-06

   Medium·CVSS 5.3 EPSS 0.42%

   h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the r...

2. DLA-4290-1 python-h2 - security update

   Published 2025-09-02

   Unknown

3. CVE-2025-57804 h2 allows HTTP Request Smuggling due to illegal characters in headers

   Published 2025-08-25

   Medium·CVSS 6.9 EPSS 1.9%

   h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.