Medium
python-h2 — security advisory
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.
- Products
- python-h2
- Affected versions
- 3.0.1-1, 3.0.1-2, 3.0.1-3, 3.0.1-4, 3.0.1-4.1ubuntu1, 3.0.1-5, 3.1.1-1, 4.0.0-3, 4.1.0-3ubuntu1, 4.1.0-4, 4.2.0-1, 4.3.0-1, 4.3.0-2
- Fixed versions
- Not specified
- CVEs
- CVE-2026-71554
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 03:14 UTC · Revision 1
Source evidence
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.
osv:UBUNTU-CVE-2026-71554
python-h2
Fixed versions: Not specified
python-h2
Fixed versions: Not specified
python-h2
Fixed versions: Not specified
python-h2
Fixed versions: Not specified
python-h2
Fixed versions: Not specified
python-h2
Fixed versions: Not specified
Complete source record
{
"id": "d665003b4903b0c8e69e08ccbaed2b5009c96c3933f492d51e66010bb95fa2b8",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-71554",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-71554",
"summary": "h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.",
"evidence": "osv:UBUNTU-CVE-2026-71554",
"products": [
{
"name": {
"value": "python-h2",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.0.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.1-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.1-3",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "python-h2",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.0.1-4",
"evidence": "/affected/1/versions"
},
{
"value": "3.0.1-4.1ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "3.0.1-5",
"evidence": "/affected/1/versions"
},
{
"value": "3.1.1-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "python-h2",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.0.0-3",
"evidence": "/affected/2/versions"
},
{
"value": "4.1.0-3ubuntu1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "python-h2",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.1.0-4",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "python-h2",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.3.0-1",
"evidence": "/affected/4/versions"
},
{
"value": "4.3.0-2",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "python-h2",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.2.0-1",
"evidence": "/affected/5/versions"
},
{
"value": "4.3.0-1",
"evidence": "/affected/5/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2026-71554",
"aliases": [
"UBUNTU-CVE-2026-71554"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python-h2",
"purl": "pkg:deb/ubuntu/python-h2?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"3.0.1-1",
"3.0.1-2",
"3.0.1-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71554.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-h2",
"binary_version": "3.0.1-3"
},
{
"binary_name": "python3-h2",
"binary_version": "3.0.1-3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python-h2",
"purl": "pkg:deb/ubuntu/python-h2?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"3.0.1-4",
"3.0.1-4.1ubuntu1",
"3.0.1-5",
"3.1.1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71554.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-h2",
"binary_version": "3.1.1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python-h2",
"purl": "pkg:deb/ubuntu/python-h2?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"4.0.0-3",
"4.1.0-3ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71554.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-h2",
"binary_version": "4.1.0-3ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python-h2",
"purl": "pkg:deb/ubuntu/python-h2?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"4.1.0-4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71554.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-h2",
"binary_version": "4.1.0-4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python-h2",
"purl": "pkg:deb/ubuntu/python-h2?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"4.3.0-1",
"4.3.0-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71554.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-h2",
"binary_version": "4.3.0-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python-h2",
"purl": "pkg:deb/ubuntu/python-h2?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"4.2.0-1",
"4.3.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-71554.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-h2",
"binary_version": "4.3.0-1"
}
]
}
}
],
"modified": "2026-10-17T13:00:46.970858848Z",
"provider": "osv",
"upstream": [
"CVE-2026-71554"
],
"references": [
"https://ubuntu.com/security/CVE-2026-71554",
"https://www.cve.org/CVERecord?id=CVE-2026-71554",
"https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg",
"https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6"
]
},
"related_cves": [
{
"value": "CVE-2026-71554",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 360829,
"published_at": "2026-08-06T22:18:00+00:00"
}