h2 allows HTTP Request Smuggling due to illegal characters in headers

🗓️ 07 Jul 2026 16:03:01Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 8 Views

Hypertext Transfer Protocol version two downgrade enables request smuggling via header carriage return line feeds.

Reporter	Title	Published	Views	Family All 57
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses h2-4.1.0-py3-none-any.whl which is vulnerable to CVE-2025-57804	29 Jun 202614:13	–	ibm
Tenable Nessus	Amazon Linux 2023 : python3-h2 (ALAS2023-2025-1181)	15 Sep 202500:00	–	nessus
Tenable Nessus	Debian dla-4290 : python3-h2 - security update	3 Sep 202500:00	–	nessus
Tenable Nessus	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-h2 (SUSE-SU-2025:03199-1)	13 Sep 202500:00	–	nessus
Tenable Nessus	SUSE SLES15 Security Update : python-h2 (SUSE-SU-2025:03273-1)	20 Sep 202500:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2025-57804	2 Sep 202500:00	–	nessus
Amazon	Medium: python-h2	15 Sep 202500:00	–	amazon
AstraLinux	Astra Linux – Vulnerability in python-h2	3 Mar 202609:29	–	astralinux
BDU FSTEC	The vulnerability of the HTTP/2 Python-h2 protocol, related to the failure to eliminate CRLF sequences, allows attackers to compromise data integrity.	12 Mar 202600:00	–	bdu_fstec
Chainguard	CVE-2025-57804 vulnerabilities	28 Aug 202520:19	–	cgr

Vulners

Node

pypi h2Range0–4.3.0

Source	Link
github	www.github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-57804
github	www.github.com/python-hyper/h2/commit/035e9899f95e3709af098f578bfc3cd302298e3a
github	www.github.com/python-hyper/h2
lists	www.lists.debian.org/debian-lts-announce/2025/09/msg00004.html
pypi	www.pypi.org/project/h2
github	www.github.com/advisories/GHSA-847f-9342-265h

07 Jul 2026 17:24Current

6Medium risk

Vulners AI Score6

CVSS 46.9

EPSS0.01596

SSVC