CVE-2026-71554

CVE-2026-71554 is a request smuggling vulnerability in the h2 Python library where multiple Host headers in an HTTP/2 request — permitted by RFC 7540 — become multiple Host headers in an HTTP/1.1 backend, where the spec explicitly forbids them. If your deployment terminates HTTP/2 at the edge and forwards to HTTP/1.1 backends (a common pattern with nginx, proxies, or API gateways), an attacker can smuggle requests by exploiting the header cardinality difference between the two protocols. Check your deployment: if h2 sits in front of any HTTP/1.1 backend, you are affected regardless of whether you intended HTTP/2-to-HTTP/2 passthrough. The vulnerability is in h2 versions prior to 4.4.1. Update immediately. Beyond patching, audit your proxy configuration — any component that accepts HTTP/2 and downgrades to HTTP/1.1 is a potential attack surface, and the fix in h2 may only address this specific header rather than the broader class of cardinality-based smuggling vectors. The EPSS score of 0.00325 reflects low active exploitation, but request smuggling has a history of remaining dormant until specific proxy configurations become common — the trigger conditions here (HTTP/2 edge, HTTP/1.1 backend) describe most production environments. Treat this as a higher priority than the raw score suggests. The deeper lesson: protocol-spec compliance and deployment safety are not the same thing. HTTP/2 permits header repetition per spec; HTTP/1.1 forbids it. A library following its own spec correctly can still create a smuggling primitive when deployment topology introduces protocol transitions the library doesn't control. Assume your HTTP/2 library will feed into HTTP/1.1 backends unless you've explicitly locked down that path.

Reviewed through automated stages and approved by a human before publication.