SUSE-SU-2026:3972-1 Security update for python-h2

This update for python-h2 fixes the following issue: - CVE-2026-71554: duplicate Host headers are accepted and forwarded to consuming applications, which can lead to request smuggling bsc1274386...

CLEANSTART-2026-XL39843 Security fixes in airflow-3 3.3.0-r3

Package airflow-3 version 3.3.0-r3 fixes 1 vulnerabilities: CVE-2026-71554...

aid-push (>=2.1.0, <=2.1.4), alexa-browser-client (>=0.3.3, <=3.3.2) +46 more potentially affected by CVE-2026-71554 via h2 (2.6.2)

h2 PYPI version 2.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on h2 and may be impacted: - aid-push =2.1.0, =0.3.3, =1.3.0, =1.2.0, =0.2.0, =0.7.1.1, =0.0.1, =0.4.0, =17.5.1, =0.1.10, =0.4.10 and more Source cves: CVE-2026-71554 Source advisory:...

Linux Distros Unpatched Vulnerability : CVE-2026-71554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host...

aapns (>=19.11.0, <=23.7.0), abq (>=0.1.0, <=0.1.4) +232 more potentially affected by CVE-2026-71554 via h2 (3.2.0)

h2 PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on h2 and may be impacted: - aapns =19.11.0, =0.1.0, =0.0.1, =0.4.0, =0.4.0, =0.1.0, =2.0.0, =20.3.0rc1, =0.2.1, =0.3.6, =0.0.1, =0.1.0, =0.0.1, =0.1.1 and more Source cves:...

acelerai (>=0.0.32, <=0.0.45), acelerai-staging (>=0.0.1, <=0.0.13) +149 more potentially affected by CVE-2026-71554 via h2 (>=4.0.0, <=4.4.0)

h2 PYPI version =4.0.0, =0.0.32, =0.0.1, =0.8.0, =0.1.3, =0.0.1, =0.2.2, =0.72.2, =1.0.0, =1.1.1 and more Source cves: CVE-2026-71554 Source advisory: OSV:GHSA-6HR6-W5QG-QMWG...

CVE-2026-71554 h2: Duplicate Host header could facilitate request smuggling

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...