CVE-2026-71554

CVE-2026-71554 affects the Python HTTP/2 stack in the h2 package. Versions up to and including 4.4.0 accept header blocks containing more than one Host header and forward all Host headers to the application. When a client downgrades HTTP/2 to HTTP/1.1, this can yield two Host header lines, enabli...