---
id: CVE-2026-71554
title: h2 is a pure-Python implementation of a HTTP/2 protocol stack
summary: >-
  h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to
  and including 4.4.0 accept request header blocks containing more than one Host
  header, and forward every Host header to the consuming application. Where the
  co…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-444
vendor: h2
product: h2
affected:
  - h2 < 4.4.1
patched:
  - h2 4.4.1
published: '2026-08-06'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71554'
references:
  - url: >-
      https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6
    label: security-advisories@github.com
  - url: 'https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg'
    label: security-advisories@github.com
  - url: 'https://github.com/python-hyper/h2'
  - url: 'https://github.com/advisories/GHSA-6hr6-w5qg-qmwg'
tags:
  - nvd
  - exploit-available
  - osv
  - pip
  - ghsa
epss: 0.00418
epssPercentile: 0.33462
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/SunandM/poc-h2-CVE-2026-71554'
  checkedAt: '2026-09-26T09:05:58.004Z'
exploitAvailable: true
aliases:
  - GHSA-6hr6-w5qg-qmwg
  - PYSEC-2026-3628
ecosystem: pip
ingestedAt: '2026-08-06T22:05:23.027Z'
---

## Overview

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-71554)

Affected packages:

- `h2 < 4.4.1`

Patched in:

- `h2 4.4.1`

Source: https://osv.dev/vulnerability/GHSA-6hr6-w5qg-qmwg