AIKIDO-2026-376044
h2 is vulnerable to HTTP Request Smuggling
53
Medium Risk
This Affects:
h2TL;DR
The h2 HTTP/2 stack accepts request header blocks that contain more than one Host header and forwards every value to the consuming application. When the consumer downgrades the HTTP/2 request to HTTP/1.1, the emitted request carries two Host header lines. That divergence between an intermediary and a backend is a request smuggling primitive that can be abused to bypass front-end security controls. The fix validates the authority in _validate_host_authority_header() and rejects header blocks that carry duplicate Host or :authority values by raising a protocol error.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application forwards or downgrades the received HTTP/2 request to an HTTP/1.1 backend.
Background info
h2 is vulnerable to HTTP Request Smuggling in versions 0.0.1 - 4.4.0.
How to fix this
Upgrade the h2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant