GeezerVison

Details

Summary

HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

References

• https://github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h
• https://github.com/python-hyper/h2/commit/035e9899f95e3709af098f578bfc3cd302298e3a
• https://nvd.nist.gov/vuln/detail/CVE-2025-57804
• https://lists.debian.org/debian-lts-announce/2025/09/msg00004.html
• https://github.com/advisories/GHSA-847f-9342-265h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Impact

h2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444).

Patches

Patched and fixed in v4.4.1

Workarounds

Users of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack.

References

Similar to the previously disclosed and fixed duplicate content-length issue.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg
• https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6
• https://github.com/advisories/GHSA-6hr6-w5qg-qmwg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

v4.4.1

Compare Source

Bugfixes

• Performance improvement: remove consumed frames in-place from data buffer.
• Reject duplicate Host headers in request headers. Thanks to Sunand Mohan for the report.

v4.4.0

Compare Source

API Changes (Backward Incompatible)

• Support for Python 3.9 has been removed.
• Support for PyPy 3.9 has been removed.
• Stream.end_stream() now raises NoSuchStreamError or StreamClosedError exceptions, instead of a generic KeyError.
• Duplicate content-length headers with different values now raise ProtocolError.
  Previously, the first content-length header was accepted and later conflicting values were ignored. Thanks to Harshal Parekh for the report.
• Parse content-length headers according to RFC9110 grammar for numbers (1*DIGIT). Thanks to Arkadiusz Marta for the report.
• backfill from v4.3.0 Convert emitted events into Python dataclass, which introduces new constructors with required arguments.
  Instantiating these events without arguments, as previously commonly used API pattern, will no longer work.

API Changes (Backward Compatible)

• Support for Python 3.14 has been added.
• H2Connection.receive_data now accepts any byte-like object that
  implements the buffer protocol, such as bytes, bytearray, and
  memoryview. Existing bytes callers are unaffected.
• Align CONNECT pseudo-header validation with RFC 9113 s8.3 and RFC 8441 s4.
  Ordinary CONNECT now requires :method=CONNECT and :authority, and
  forbids :scheme/:path. Extended CONNECT (e.g., WebSocket) requires
  :scheme, :path, :authority plus :protocol. (PR #​1309)
• Fix incorrect substring matching of secure header in cookie and :method.

Bugfixes

• Fix to allow sending 0 bytes on a stream even if the flow control window is negative.
• Reject non-zero SETTINGS_ENABLE_PUSH values received from servers.

v4.3.0

Compare Source

API Changes (Backward Incompatible)

• Reject header names and values containing illegal characters, based on RFC 9113, section 8.2.1.
  The main Python API is compatible, but some previously valid requests/response headers might now be blocked.
  Use the validate_inbound_headers config option if needed.
  Thanks to Sebastiano Sartor (sebsrt) for the report.
• Convert emitted events into Python dataclass, which introduces new constructors with required arguments.
  Instantiating these events without arguments, as previously commonly used API pattern, will no longer work.

API Changes (Backward Compatible)

• h2 events now have tighter type bounds, e.g. stream_id is guaranteed to not be None for most events now.
  This simplifies downstream type checking.
• Various typing-related improvements.

Bugfixes

• Fix error value when opening a new stream on too many open streams.

v4.2.0

Compare Source

API Changes (Backward Incompatible)

• Support for Python 3.6 has been removed.
• Support for Python 3.7 has been removed.
• Support for Python 3.8 has been removed.
• Remove mistakenly set max_inbound_frame_size attribute on H2Stream.

API Changes (Backward Compatible)

• Support for Python 3.11 has been added.
• Support for Python 3.12 has been added.
• Support for Python 3.13 has been added.
• Add an ability to send outbound cookies separately to improve headers compression.
• Updated packaging and testing infrastructure.

Bugfixes

• Fix repr() checks for Python 3.11
• Fix asyncio / wsgi examples.
• Clarify docs on using curl with http2.