h2 vulnerabilities
CVEs whose affected-version data names the h2 package (pip, rust). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
RUSTSEC-2026-0258Noneh2 unbounded empty DATA frames
h2 unbounded empty DATA frames
▾ Sunlith2 · h2via OSV
CVE-2026-71554Medium· 5.3PoCh2 is a pure-Python implementation of a HTTP/2 protocol stack
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the co…
▾ Twilighth2 · h2EPSS 0.44%via NVD
CVE-2025-57804Mediumh2 allows HTTP Request Smuggling due to illegal characters in headers
h2 allows HTTP Request Smuggling due to illegal characters in headers
▾ Sunlith2 · h2EPSS 1.7%via OSV