CVE-2026-71554
Last modified
CVE-2026-71554 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. EPSS estimates a 0.33% chance of exploitation in the next 30 days.
Description
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| python-hyper | h2 | < 4.4.1 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-71554?
How severe is CVE-2026-71554?
How do I fix CVE-2026-71554?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-71502CTI-Transmute contains a stored cross-site scripting vulnera…5.1
- CVE-2026-7151A vulnerability was determined in Tenda HG3 2.0. Impacted is…8.8
- CVE-2026-7152A vulnerability was identified in Totolink A8000RU 7.1cu.643…9.8
- CVE-2026-7153A security flaw has been discovered in Totolink A8000RU 7.1c…9.8
- CVE-2026-7154A weakness has been identified in Totolink A8000RU 7.1cu.643…9.8
- CVE-2026-7155A security vulnerability has been detected in Totolink A8000…9.8
- CVE-2026-71555PILOS (Platform for Interactive Live-Online Seminars) is a f…4.1
- CVE-2026-71556go-git is an extensible git implementation library written i…7.1
- CVE-2026-71557go-git is an extensible git implementation library written i…6.3
- CVE-2026-71558Heap type confusion vulnerability in Apache Fory C++ deseria…9.8
- CVE-2026-71559Deserialization of Untrusted Data vulnerability in the Go im…7.5
- CVE-2026-7156A vulnerability was detected in Totolink A8000RU 7.1cu.643_b…9.8
Are you affected by CVE-2026-71554?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST