https://vulnerability.circl.lu/sightings/feed 2026-08-09T22:53:18.520382+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/22c08f94-3845-472f-8323-cf184950b966/export 2026-08-09T22:53:18.542997+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "22c08f94-3845-472f-8323-cf184950b966", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71554", "type": "published-proof-of-concept", "source": "Telegram/SJgsYpMApmH3kxQGJCGNQpcz-GAta1cAcJiXzXwEzvRKjsI", "content": "", "creation_timestamp": "2026-08-09T01:13:05.606637Z"} 2026-08-09T01:13:05.606637+00:00 https://vulnerability.circl.lu/sighting/9b4bd60d-e070-4e82-af0f-24827f4e133d/export 2026-08-09T22:53:18.545540+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "9b4bd60d-e070-4e82-af0f-24827f4e133d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71554", "type": "published-proof-of-concept", "source": "Telegram/wFizrrbAMDFnDVCm6fOMsyo-M7GcVmnQt0S9VRUliYzF6W4", "content": "", "creation_timestamp": "2026-08-09T01:13:05.486219Z"} 2026-08-09T01:13:05.486219+00:00 https://vulnerability.circl.lu/sighting/7a69f22b-f24f-4c6d-bfde-e1eb90ae25ce/export 2026-08-09T22:53:18.545627+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "7a69f22b-f24f-4c6d-bfde-e1eb90ae25ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71554", "type": "published-proof-of-concept", "source": "Telegram/SJgsYpMApmH3kxQGJCGNQpcz-GAta1cAcJiXzXwEzvRKjsI", "content": "", "creation_timestamp": "2026-08-08T23:06:33.386725Z"} 2026-08-08T23:06:33.386725+00:00 https://vulnerability.circl.lu/sighting/bf2372dc-ca8a-4175-9363-e4e3f3899eed/export 2026-08-09T22:53:18.545697+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "bf2372dc-ca8a-4175-9363-e4e3f3899eed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71554", "type": "published-proof-of-concept", "source": "Telegram/wFizrrbAMDFnDVCm6fOMsyo-M7GcVmnQt0S9VRUliYzF6W4", "content": "", "creation_timestamp": "2026-08-08T23:04:23.238769Z"} 2026-08-08T23:04:23.238769+00:00 https://vulnerability.circl.lu/sighting/ad394231-ec00-4486-8ddb-5190b36f7322/export 2026-08-09T22:53:18.545759+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "ad394231-ec00-4486-8ddb-5190b36f7322", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71554", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97084", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a poc-h2-CVE-2026-71554\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a SunandM\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-07 21:19:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-71554 - h2 duplicate Host header request smuggling primitive (fixed in 4.4.1)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-08T00:02:15.288832Z"} 2026-08-08T00:02:15.288832+00:00 https://vulnerability.circl.lu/sighting/9685803f-b79f-4a79-86fa-f588d4a412e0/export 2026-08-09T22:53:18.545830+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "9685803f-b79f-4a79-86fa-f588d4a412e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71554", "type": "seen", "source": "https://gist.github.com/alon710/91251538851544e4ecb69dd2c9aa7a2b", "content": "# CVE-2026-71554: CVE-2026-71554: HTTP Request Smuggling via Duplicate Host Headers in h2 Protocol Stack\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71554\n\n## Summary\nA protocol-parsing vulnerability in the pure-Python HTTP/2 library 'h2' (versions <= 4.4.0) allows unauthenticated remote attackers to perform HTTP Request Smuggling (CWE-444). The vulnerability exists because the library does not validate the uniqueness of 'Host' headers in incoming HTTP/2 request streams. When an upstream gateway parses such requests and downgrades them to HTTP/1.1 for internal backend servers, the resulting stream contains duplicate Host headers, which leads to parsing inconsistency and potential bypass of security filters.\n\n## TL;DR\nThe 'h2' Python library fails to reject HTTP/2 streams containing multiple 'Host' headers. If an intermediary proxy downgrades these streams to HTTP/1.1, the duplicate headers are forwarded, triggering HTTP Request Smuggling.\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **Impact**: Low Integrity & Availability (Potential HTTP Request Smuggling)\n- **Exploit Status**: none (Theoretical / No public PoCs available)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Python environments utilizing the h2 (python-hyper) library version <= 4.4.0\n- ASGI web servers and Python reverse proxies performing HTTP/2 to HTTP/1.1 translation\n- **h2**: < 4.4.1 (Fixed in: `4.4.1`)\n\n## Mitigation\n\n- Upgrade the 'h2' library to version 4.4.1 or later immediately.\n- Filter out incoming requests at the outer perimeter proxy (e.g., Cloudflare, AWS ALB, NGINX) that contain multiple Host headers before they reach Python-based backend proxies.\n- Ensure backend web servers or downstream parsers strictly reject any incoming HTTP/1.1 requests containing duplicate Host headers with a 400 Bad Request error code, adhering to RFC 9112 Section 3.2.\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade h2' or update project lockfiles (Poetry, Pipenv) to specify 'h2>=4.4.1'.\n2. Verify the installed version of 'h2' by executing: python -c \"import h2; print(h2.__version__)\"\n3. Restart ASGI servers and Python-based proxies to load the patched dependency code into memory.\n4. Audit downstream systems to confirm that they properly reject requests containing duplicate HTTP/1.1 Host headers.\n\n## References\n\n- [NVD Record for CVE-2026-71554](https://nvd.nist.gov/vuln/detail/CVE-2026-71554)\n- [GitHub Security Advisory GHSA-6hr6-w5qg-qmwg](https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg)\n- [Vulnerability Fix Commit](https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6)\n- [Python-Hyper h2 Repository](https://github.com/python-hyper/h2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71554) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-07T00:07:12.284645Z"} 2026-08-07T00:07:12.284645+00:00 https://vulnerability.circl.lu/sighting/a0bbf0c4-c205-4dbd-bf57-3b9819e65386/export 2026-08-09T22:53:18.545921+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "a0bbf0c4-c205-4dbd-bf57-3b9819e65386", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71554", "type": "seen", "source": "https://gist.github.com/alon710/91251538851544e4ecb69dd2c9aa7a2b", "content": "# CVE-2026-71554: CVE-2026-71554: HTTP Request Smuggling via Duplicate Host Headers in h2 Protocol Stack\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71554\n\n## Summary\nA protocol-parsing vulnerability in the pure-Python HTTP/2 library 'h2' (versions <= 4.4.0) allows unauthenticated remote attackers to perform HTTP Request Smuggling (CWE-444). The vulnerability exists because the library does not validate the uniqueness of 'Host' headers in incoming HTTP/2 request streams. When an upstream gateway parses such requests and downgrades them to HTTP/1.1 for internal backend servers, the resulting stream contains duplicate Host headers, which leads to parsing inconsistency and potential bypass of security filters.\n\n## TL;DR\nThe 'h2' Python library fails to reject HTTP/2 streams containing multiple 'Host' headers. If an intermediary proxy downgrades these streams to HTTP/1.1, the duplicate headers are forwarded, triggering HTTP Request Smuggling.\n\n## Technical Details\n\n- **CWE ID**: CWE-444\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **Impact**: Low Integrity & Availability (Potential HTTP Request Smuggling)\n- **Exploit Status**: none (Theoretical / No public PoCs available)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Python environments utilizing the h2 (python-hyper) library version <= 4.4.0\n- ASGI web servers and Python reverse proxies performing HTTP/2 to HTTP/1.1 translation\n- **h2**: < 4.4.1 (Fixed in: `4.4.1`)\n\n## Mitigation\n\n- Upgrade the 'h2' library to version 4.4.1 or later immediately.\n- Filter out incoming requests at the outer perimeter proxy (e.g., Cloudflare, AWS ALB, NGINX) that contain multiple Host headers before they reach Python-based backend proxies.\n- Ensure backend web servers or downstream parsers strictly reject any incoming HTTP/1.1 requests containing duplicate Host headers with a 400 Bad Request error code, adhering to RFC 9112 Section 3.2.\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade h2' or update project lockfiles (Poetry, Pipenv) to specify 'h2>=4.4.1'.\n2. Verify the installed version of 'h2' by executing: python -c \"import h2; print(h2.__version__)\"\n3. Restart ASGI servers and Python-based proxies to load the patched dependency code into memory.\n4. Audit downstream systems to confirm that they properly reject requests containing duplicate HTTP/1.1 Host headers.\n\n## References\n\n- [NVD Record for CVE-2026-71554](https://nvd.nist.gov/vuln/detail/CVE-2026-71554)\n- [GitHub Security Advisory GHSA-6hr6-w5qg-qmwg](https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg)\n- [Vulnerability Fix Commit](https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6)\n- [Python-Hyper h2 Repository](https://github.com/python-hyper/h2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71554) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T23:32:34.198265Z"} 2026-08-06T23:32:34.198265+00:00