CVE-2026-71554Medium· 5.3▾ TwilightPoC availableh2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the co…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.4%
1 GitHub repo
Last analysed / modified upstream
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
h2 < 4.4.1Patched in:
h2 4.4.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-57804Mediumh2 allows HTTP Request Smuggling due to illegal characters in headers
RUSTSEC-2026-0258Noneh2 unbounded empty DATA frames
CVE-2024-14029High· 7.5Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request
CVE-2023-41265Critical· 9.6An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier all…
CVE-2026-69243High· 7.0AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
CVE-2026-48746Critical· 9.1vLLM is an inference and serving engine for large language models (LLMs)