CVE-2026-71554 h2: Duplicate Host header could facilitate request smuggling
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-71554?
CVE-2026-71554 is a medium-severity vulnerability in python-hyper h2, published on 6 Aug 2026.
Official description
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.
Weakness: CWE-444
Which versions are affected by CVE-2026-71554?
3 open source packages ship an affected version, including h2.
| Package | Affected | Fixed in |
|---|---|---|
h2 PyPI | All versions | 4.4.1 |
h2 PyPI | All versions | 4.4.1 |
h2 PyPI | All versions | 4.4.1 |
Linux distribution packages (6)
python-h2 SUSE:Linux Enterprise Module for Python 3 15 SP7 | All versions | 4.1.0-150400.8.9.1 |
python-h2 SUSE:Linux Enterprise Module for Server Applications 15 SP7 | All versions | 3.2.0-150200.3.8.1 |
python-h2 SUSE:Linux Enterprise Server 16.0 | All versions | 4.2.0-160000.4.1 |
python-h2 SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 4.2.0-160000.4.1 |
python-h2 openSUSE:Leap 16.0 | All versions | 4.2.0-160000.4.1 |
python-h2 openSUSE:Tumbleweed | All versions | 4.4.1-1.1 |
How do I fix CVE-2026-71554?
Upgrade h2 to 4.4.1 or later.
Is CVE-2026-71554 being exploited?
There is no known exploitation of CVE-2026-71554 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as BELL-CVE-2026-71554, CLEANSTART-2026-VQ36233, DEBIAN-CVE-2026-71554, ECHO-0f77-53c4-f946, GHSA-6hr6-w5qg-qmwg, MGASA-2026-0409 and 10 more.