DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-71554: CVE-2026-71554: HTTP Request Smuggling via Duplicate Host Headers in h2 Protocol Stack

#security #cve #cybersecurity

CVE-2026-71554: HTTP Request Smuggling via Duplicate Host Headers in h2 Protocol Stack

Vulnerability ID: CVE-2026-71554
CVSS Score: 5.3
Published: 2026-08-06

A protocol-parsing vulnerability in the pure-Python HTTP/2 library 'h2' (versions <= 4.4.0) allows unauthenticated remote attackers to perform HTTP Request Smuggling (CWE-444). The vulnerability exists because the library does not validate the uniqueness of 'Host' headers in incoming HTTP/2 request streams. When an upstream gateway parses such requests and downgrades them to HTTP/1.1 for internal backend servers, the resulting stream contains duplicate Host headers, which leads to parsing inconsistency and potential bypass of security filters.

TL;DR

The 'h2' Python library fails to reject HTTP/2 streams containing multiple 'Host' headers. If an intermediary proxy downgrades these streams to HTTP/1.1, the duplicate headers are forwarded, triggering HTTP Request Smuggling.

Technical Details

  • CWE ID: CWE-444
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 5.3 (Medium)
  • Impact: Low Integrity & Availability (Potential HTTP Request Smuggling)
  • Exploit Status: none (Theoretical / No public PoCs available)
  • KEV Status: Not Listed

Affected Systems

  • Python environments utilizing the h2 (python-hyper) library version <= 4.4.0
  • ASGI web servers and Python reverse proxies performing HTTP/2 to HTTP/1.1 translation
  • h2: < 4.4.1 (Fixed in: 4.4.1)

Code Analysis

Commit: 292a408

Fix: Enforce single host header in request validation flow

Mitigation Strategies

  • Upgrade the 'h2' library to version 4.4.1 or later immediately.
  • Filter out incoming requests at the outer perimeter proxy (e.g., Cloudflare, AWS ALB, NGINX) that contain multiple Host headers before they reach Python-based backend proxies.
  • Ensure backend web servers or downstream parsers strictly reject any incoming HTTP/1.1 requests containing duplicate Host headers with a 400 Bad Request error code, adhering to RFC 9112 Section 3.2.

Remediation Steps:

  1. Run 'pip install --upgrade h2' or update project lockfiles (Poetry, Pipenv) to specify 'h2>=4.4.1'.
  2. Verify the installed version of 'h2' by executing: python -c "import h2; print(h2.version)"
  3. Restart ASGI servers and Python-based proxies to load the patched dependency code into memory.
  4. Audit downstream systems to confirm that they properly reject requests containing duplicate HTTP/1.1 Host headers.

References

Read the full report for CVE-2026-71554 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)