{"uuid": "9685803f-b79f-4a79-86fa-f588d4a412e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71554", "type": "seen", "source": "https://gist.github.com/alon710/91251538851544e4ecb69dd2c9aa7a2b", "content": "# CVE-2026-71554: CVE-2026-71554: HTTP Request Smuggling via Duplicate Host Headers in h2 Protocol Stack\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71554\n\n## Summary\nA protocol-parsing vulnerability in the pure-Python HTTP/2 library 'h2' (versions <= 4.4.0) allows unauthenticated remote attackers to perform HTTP Request Smuggling (CWE-444). The vulnerability exists because the library does not validate the uniqueness of 'Host' headers in incoming HTTP/2 request streams. When an upstream gateway parses such requests and downgrades them to HTTP/1.1 for internal backend servers, the resulting stream contains duplicate Host headers, which leads to parsing inconsistency and potential bypass of security filters.\n\n## TL;DR\nThe 'h2' Python library fails to reject HTTP/2 streams containing multiple 'Host' headers. If an intermediary proxy downgrades these streams to HTTP/1.1, the duplicate headers are forwarded, triggering HTTP Request Smuggling.\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **Impact**: Low Integrity & Availability (Potential HTTP Request Smuggling)\n- **Exploit Status**: none (Theoretical / No public PoCs available)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Python environments utilizing the h2 (python-hyper) library version <= 4.4.0\n- ASGI web servers and Python reverse proxies performing HTTP/2 to HTTP/1.1 translation\n- **h2**: < 4.4.1 (Fixed in: `4.4.1`)\n\n## Mitigation\n\n- Upgrade the 'h2' library to version 4.4.1 or later immediately.\n- Filter out incoming requests at the outer perimeter proxy (e.g., Cloudflare, AWS ALB, NGINX) that contain multiple Host headers before they reach Python-based backend proxies.\n- Ensure backend web servers or downstream parsers strictly reject any incoming HTTP/1.1 requests containing duplicate Host headers with a 400 Bad Request error code, adhering to RFC 9112 Section 3.2.\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade h2' or update project lockfiles (Poetry, Pipenv) to specify 'h2>=4.4.1'.\n2. Verify the installed version of 'h2' by executing: python -c \"import h2; print(h2.__version__)\"\n3. Restart ASGI servers and Python-based proxies to load the patched dependency code into memory.\n4. Audit downstream systems to confirm that they properly reject requests containing duplicate HTTP/1.1 Host headers.\n\n## References\n\n- [NVD Record for CVE-2026-71554](https://nvd.nist.gov/vuln/detail/CVE-2026-71554)\n- [GitHub Security Advisory GHSA-6hr6-w5qg-qmwg](https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg)\n- [Vulnerability Fix Commit](https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6)\n- [Python-Hyper h2 Repository](https://github.com/python-hyper/h2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71554) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T00:07:12.284645Z"}