CVE-2026-71554

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.

• CWE-444

• https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6
• https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg

Published

Aug 6, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7154A weakness has been identified in Totolink A8000RU 7.1cu.643…9.8
• CVE-2026-71540Wazuh is an open-source security platform providing unified …7.5
• CVE-2026-71543OpenBao is an open source identity-based secrets management …7.5
• CVE-2026-7155A security vulnerability has been detected in Totolink A8000…9.8
• CVE-2026-71551Super Productivity is an advanced todo list app with integra…7.8
• CVE-2026-71553ApostropheCMS is an open-source Node.js content management s…7.1
• CVE-2026-71555PILOS (Platform for Interactive Live-Online Seminars) is a f…4.1
• CVE-2026-71556go-git is an extensible git implementation library written i…7.1
• CVE-2026-71557go-git is an extensible git implementation library written i…6.3
• CVE-2026-71558Heap type confusion vulnerability in Apache Fory C++ deseria…9.8
• CVE-2026-71559Deserialization of Untrusted Data vulnerability in the Go im…7.5
• CVE-2026-7156A vulnerability was detected in Totolink A8000RU 7.1cu.643_b…9.8