CVE-2026-71554: h2: Duplicate Host header could facilitate request smuggling

August 6, 2026

h2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444).

References

github.com/advisories/GHSA-6hr6-w5qg-qmwg
github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6
github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg
nvd.nist.gov/vuln/detail/CVE-2026-71554

Code Behaviors & Features

Detect and mitigate CVE-2026-71554 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →