CVE-2026-71554: python-hyper h2 HTTP Request/Response Smuggling
CVSS: 5.3v3.1MediumDeferred
AliasesMGASA-2026-0409SUSE-SU-2026:23563-1SUSE-SU-2026:3970-1SUSE-SU-2026:3972-1GHSA-6hr6-w5qg-qmwgPYSEC-2026-3628UBUNTU-CVE-2026-71554DEBIAN-CVE-2026-71554CGA-4wq6-jjp2-rh37CGA-8q47-fp24-cff7CGA-96gv-ffxq-mxq2CGA-hvrr-vwr2-7r5fCGA-j42f-7xjp-43hqCGA-mfm8-q5cm-cpxcCGA-wrgj-rrpp-jc53openSUSE-SU-2026:11523-1openSUSE-SU-2026:21693-1CGA-22gc-9wr5-hf3pCGA-356j-r2rw-prf6CGA-4m4r-2rrx-j78qCGA-4q2c-j474-mrcgCGA-68r9-gjfh-9985CGA-765v-678v-p5gpCGA-9hrf-q8c3-vj56CGA-cq92-q829-p4x7CGA-cwmr-xcv6-x9v6CGA-f48g-q8p3-wxfpCGA-f99h-24f4-9388CGA-fm4m-3g27-x3mhCGA-fqmw-223p-q9ppCGA-frgg-39x8-vvf9CGA-hvr8-m3c8-425gCGA-j68p-qpqj-gq8xCGA-j8q3-ch3h-44xxCGA-jp9j-rfj2-r88rCGA-m73j-gh7v-8773CGA-px4h-8wj4-4f4gCGA-q26v-j873-5jj7CGA-qqr2-j83q-mpcrCGA-rjmp-4mxh-252jCGA-v7cm-gwmc-fxpwCGA-wq2r-4www-6fxwCGA-xhpp-8xgm-4r52
Published 06-08-2026Last modified 08-08-2026
Vulnerability summary
CVE-2026-71554 is a medium (CVSS 5.3) HTTP Request/Response Smuggling vulnerability in python-hyper h2. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 34.7% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)EPSS score
0.42%
0%100%
Low · -0.03 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 06-08-2026PublishedVulnerability first disclosed.
- 08-08-2026Last modifiedVulnerability information updated.
Description
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.
CVSS metrics
7 scores · 7 sources · 1 versionMedium 5.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSourcesAll 7 agree
- OSV · PypiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
-0.03 pp
From 0.44% on 19-09-2026
19-09-202619-10-2026
EPSS score0.42%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard17 products
- airflow-2All versions (No fix recorded)
- airflow-3< 3.3.1-r0
- airflow-3-iamguarded-compatAll versions (No fix recorded)
- apache-beam-python-3.14-sdk< 2.75.0-r2
- authentik-2025.12All versions (No fix recorded)
Suse4 products
- python-h2&distro=SUSE Linux Enterprise Module for Python 3 15 SP7< 4.1.0-150400.8.9.1
- python-h2&distro=SUSE Linux Enterprise Module for Server Applications 15 SP7< 3.2.0-150200.3.8.1
- python-h2&distro=SUSE Linux Enterprise Server 16.0< 4.2.0-160000.4.1
- python-h2&distro=SUSE Linux Enterprise Server for SAP applications 16.0< 4.2.0-160000.4.1
Wolfi4 products
- airflow-3< 3.3.1-r0
- airflow-3-iamguarded-compatAll versions (No fix recorded)
- mitmproxy< 12.2.3-r5
- open-webui< 0.11.0-r2 | < 0.11.0-r1
Mageia2 products
- python-h2< 4.3.0-1.1.mga10
- python-h2< 4.1.0-2.1.mga9
Opensuse2 products
- python-h2&distro=openSUSE Leap 16.0< 4.2.0-160000.4.1
- python-h2&distro=openSUSE Tumbleweed< 4.4.1-1.1
Debian1 product
- python-h2All versions (No fix recorded)
PyPI1 product
- h2< 4.4.1
Python-hyper1 product
- h2< 4.4.1
Ubuntu1 product
- python-h2All versions (No fix recorded)
9 vendors · 33 products
References
18 links- github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwgX Refsource CONFIRMAdvisoryWEBREPORT
- github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6X Refsource MISCWEBREPORTFIX
Show all 18 references
- github.com/python-hyper/h2PACKAGE
- pypi.org/project/h2PACKAGE
