GHSA-847F-9342-265H h2 allows HTTP Request Smuggling due to illegal characters in headers

🗓️ 25 Aug 2025 20:44:43Reported by GoogleType

osv

osv🔗 osv.dev👁 1 Views

HTTP/2 downgrade enables request smuggling via CRLF in headers due to improper header validation.

Reporter	Title	Published	Views	Family All 54
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses h2-4.1.0-py3-none-any.whl which is vulnerable to CVE-2025-57804	29 Jun 202614:13	–	ibm
Tenable Nessus	Amazon Linux 2023 : python3-h2 (ALAS2023-2025-1181)	15 Sep 202500:00	–	nessus
Tenable Nessus	Debian dla-4290 : python3-h2 - security update	3 Sep 202500:00	–	nessus
Tenable Nessus	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-h2 (SUSE-SU-2025:03199-1)	13 Sep 202500:00	–	nessus
Tenable Nessus	SUSE SLES15 Security Update : python-h2 (SUSE-SU-2025:03273-1)	20 Sep 202500:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2025-57804	2 Sep 202500:00	–	nessus
Amazon	Medium: python-h2	15 Sep 202500:00	–	amazon
AstraLinux	Astra Linux – Vulnerability in python-h2	13 Jan 202614:01	–	astralinux
BDU FSTEC	The vulnerability of the HTTP/2 Python-h2 protocol, related to the failure to eliminate CRLF sequences, allows attackers to compromise data integrity.	12 Mar 202600:00	–	bdu_fstec
Chainguard	CVE-2025-57804 vulnerabilities	28 Aug 202520:19	–	cgr

Source	Link
github	www.github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-57804
github	www.github.com/python-hyper/h2/commit/035e9899f95e3709af098f578bfc3cd302298e3a
github	www.github.com/python-hyper/h2
lists	www.lists.debian.org/debian-lts-announce/2025/09/msg00004.html

07 Jul 2026 17:56Current

6.4Medium risk

Vulners AI Score6.4

CVSS 46.9

EPSS0.01596

hypertext transfer protocol request smuggling header validation carriage return linefeed protocol downgrade