CVE-2026-71554

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71554", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-06T21:24:15.376Z", "datePublished": "2026-08-06T21:46:43.057Z", "dateUpdated": "2026-08-08T02:49:30.505Z"}, "containers": {"cna": {"title": "h2: Duplicate Host header could facilitate request smuggling", "problemTypes": [{"descriptions": [{"cweId": "CWE-444", "lang": "en", "description": "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg"}, {"name": "https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6", "tags": ["x_refsource_MISC"], "url": "https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6"}], "affected": [{"vendor": "python-hyper", "product": "h2", "versions": [{"version": "< 4.4.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T21:46:43.057Z"}, "descriptions": [{"lang": "en", "value": "h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1."}], "source": {"advisory": "GHSA-6hr6-w5qg-qmwg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-08T02:49:21.263516Z", "id": "CVE-2026-71554", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-08T02:49:30.505Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71554", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-08T02:49:21.263516Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-08T02:49:26.583Z"}}], "cna": {"title": "h2: Duplicate Host header could facilitate request smuggling", "source": {"advisory": "GHSA-6hr6-w5qg-qmwg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "python-hyper", "product": "h2", "versions": [{"status": "affected", "version": "< 4.4.1"}]}], "references": [{"url": "https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg", "name": "https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6", "name": "https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T21:46:43.057Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71554", "state": "PUBLISHED", "dateUpdated": "2026-08-08T02:49:30.505Z", "dateReserved": "2026-08-06T21:24:15.376Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-06T21:46:43.057Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "h2", "vendor": "python-hyper", "versions": [{"status": "affected", "version": "< 4.4.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1."}, {"lang": "es", "value": "h2 es una implementaci\u00f3n puramente en Python de una pila del protocolo HTTP/2. Las versiones hasta la 4.4.0 inclusive aceptan bloques de encabezado de solicitud que contienen m\u00e1s de un encabezado Host, y reenv\u00edan cada encabezado Host a la aplicaci\u00f3n consumidora. Cuando el consumidor degrada HTTP/2 a HTTP/1.1, la solicitud resultante lleva dos l\u00edneas de encabezado Host, lo que proporciona una primitiva de contrabando de solicitudes. Este problema se corrige en la versi\u00f3n 4.4.1."}], "id": "CVE-2026-71554", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71554", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-08T02:49:21.263516Z", "version": "2.0.3"}}]}, "published": "2026-08-06T22:18:32.403", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6"}, {"source": "security-advisories@github.com", "url": "https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.4.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "h2", "vendor": "python-hyper"}], "created": "2026-08-07T00:45:04.368669+00:00", "updated": "2026-08-07T09:58:41.489914+00:00", "vendors": ["python-hyper", "python-hyper$PRODUCT$h2"]}