Description

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-06T22:18:32.403Z",
  "pubdate": "2026-08-06T22:18:32.403Z",
  "executiveSummary": "The h2 software, specifically in versions up to and including 4.4.0, suffers from a request smuggling vulnerability caused by the improper handling of HTTP/2 request header blocks containing multiple Host headers. As a pure-Python implementation of the HTTP/2 protocol stack, h2 accepts multiple Host header fields within a single request and forwards every instance to the consuming application without prior validation or sanitization.\nThe primary impact of this vulnerability manifests when downstream consuming applications downgrade the incoming HTTP/2 protocol stream to HTTP/1.1. Because the duplicate Host headers are preserved and forwarded, the resulting outgoing HTTP/1.1 request carries two distinct Host header lines, violating RFC specifications and creating a reliable request smuggling primitive.\nThe risk implications include potential bypass of security controls, cache poisoning, unauthorized access to sensitive backend services, and request hijacking depending on how intermediate proxies and downstream servers interpret the conflicting headers. Attackers can exploit this capability remotely over the network by crafting malicious HTTP/2 requests containing duplicate pseudo-header fields or regular header blocks for the target host.\nNo specific authentication or high-level privileges are required to initiate the attack vector against exposed services. Remediation requires updating the affected software to version 4.4.1 or later, where proper header validation logic has been implemented to reject or sanitize multiple Host headers.",
  "technicalDetails": "The root cause of this vulnerability lies in the parser and state machine logic of the h2 protocol stack, which fails to enforce strict RFC compliance regarding the uniqueness of the Host header field within HTTP/2 request header blocks. In HTTP/2, the pseudo-header ':authority' or the traditional 'host' header should map to a single logical destination per request stream.\nThe vulnerable component is the header processing module within h2 versions up to and including 4.4.0. When an attacker submits a request containing multiple Host headers, the h2 library processes and populates the header block structure, forwarding every supplied Host header directly to the consuming application layer.\nExploitation occurs via the network when an attacker transmits a maliciously crafted HTTP/2 request containing more than one Host header to a service utilizing the h2 library. The attack flow proceeds as follows: first, the attacker initiates a standard HTTP/2 connection and sends a request stream with multiple Host headers. Second, the h2 library accepts the headers and passes them downstream to the consumer application. Third, the consumer application translates or downgrades the HTTP/2 request into an HTTP/1.1 format to communicate with backend infrastructure or internal microservices. Fourth, the resulting HTTP/1.1 request is serialized with multiple Host header lines.\nBecause standard HTTP/1.1 parsers, reverse proxies, load balancers, and backend web servers handle multiple Host headers inconsistently—often prioritizing either the first or the last occurrence—discrepancies arise in request boundary interpretation. This ambiguity enables request smuggling, allowing an attacker to prepend or append supplementary HTTP traffic that is interpreted by the backend as a separate, distinct request.\nThe network exposure is broad, affecting any publicly accessible server utilizing h2 for HTTP/2 protocol termination or proxying where protocol downgrading to HTTP/1.1 occurs. Post-exploitation impact varies based on architecture but commonly includes cache poisoning, credential theft, bypass of web application firewalls, and unauthorized request routing."
}