CyberRota Analysis
AI-GeneratedThe h2 library, a pure-Python implementation of the HTTP/2 protocol, is vulnerable in versions up to 4.4.0 due to its acceptance of multiple Host headers, which can lead to request smuggling when downgraded to HTTP/1.1. This vulnerability could allow attackers to manipulate request handling, potentially leading to unauthorized access or data leakage. Users of the h2 library, especially those handling sensitive web traffic, should prioritize upgrading to version 4.4.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.