AIKIDO-2026-376044
h2 is vulnerable to HTTP Request Smuggling
53
CVE Score
Medium
HTTP Request Smuggling
TL;DR
The h2 HTTP/2 stack accepts request header blocks that contain more than one Host header and forwards every value to the consuming application. When the consumer downgrades the HTTP/2 request to HTTP/1.1, the emitted request carries two Host header lines. That divergence between an intermediary and a backend is a request smuggling primitive that can be abused to bypass front-end security controls. The fix validates the authority in _validate_host_authority_header() and rejects header blocks that carry duplicate Host or :authority values by raising a protocol error.
How do I fix this?
Upgrade the h2 library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application forwards or downgrades the received HTTP/2 request to an HTTP/1.1 backend.
Package
Versions
0.0.1 - 4.4.0
Fixed in 4.4.1Background info
h2 is vulnerable to HTTP Request Smuggling in versions 0.0.1 - 4.4.0.
Links
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.