CVE-2026-71554

Name of the Vulnerable Software and Affected Versions h2 versions prior to 4.4.1

Description The software accepts request header blocks containing multiple Host headers and forwards all of them to the consuming application. When the consumer downgrades the connection from HTTP/2 to HTTP/1.1, the resulting request contains two Host header lines. This behavior creates a request smuggling primitive, which occurs when an attacker can interfere with the way a website processes sequences of HTTP requests.

Recommendations Update to version 4.4.1. Check and follow HTTP semantics best practices in the application code to ensure proper and safe usage of HTTP/2.