{"id":"CVE-2025-57804","aliases":["GHSA-847f-9342-265h","PYSEC-2026-1435"],"title":"h2 allows HTTP Request Smuggling due to illegal characters in headers","summary":"h2 allows HTTP Request Smuggling due to illegal characters in headers","severity":"medium","vendor":"h2","product":"h2","ecosystem":"pip","affected":["h2 < 4.3.0"],"patched":["h2 4.3.0"],"published":"2025-08-25","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:26.965133425Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-847f-9342-265h","references":[{"url":"https://github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57804"},{"url":"https://github.com/python-hyper/h2/commit/035e9899f95e3709af098f578bfc3cd302298e3a"},{"url":"https://github.com/python-hyper/h2"},{"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00004.html"}],"tags":["osv","pip"],"epss":0.01725,"epssPercentile":0.76555,"ingestedAt":"2026-07-08T18:25:47.291Z","slug":"CVE-2025-57804","body":"## Overview\n\n### Summary\n\nHTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.\n\n## Affected packages\n\n- `h2 < 4.3.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `h2 4.3.0`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}