N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-57804

CVE-2025-57804: h2 allows HTTP Request Smuggling due to illegal characters in headers

Summary

HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-57804

CVE-2025-57804:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
h2	pip	< 4.3.0	4.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-847f-9342-265h, is a classic case of HTTP Request Smuggling due to improper handling of special characters (CRLF) in HTTP headers. The h2 library, when used by a server that downgrades HTTP/2 requests to HTTP/1.1, failed to properly sanitize header fields. This allowed a malicious client to inject CRLF sequences into headers, which could be interpreted by a backend server as the boundary for a new request.

The analysis of the fixing commit 035e9899f95e3709af098f578bfc3cd302298e3a points to two key functions in src/h2/utilities.py.

_reject_unpermitted_characters: This was the function with the flawed logic. It only checked for \r, \n, and \x00, which was an incomplete implementation of the checks required by the relevant RFCs. An attacker could use other control characters to bypass this check. The entire function was removed as part of the fix.
validate_headers: This function acts as the entry point for header validation. It was vulnerable because it relied on the inadequate _reject_unpermitted_characters function. The patch retargets this function to call a new, more secure function, _reject_illegal_characters, which implements the stricter validation rules defined in RFC 9113.

During a potential exploit, a profiler would show validate_headers being called, which in turn would execute the vulnerable character validation logic within _reject_unpermitted_characters in unpatched versions. Therefore, both functions are critical runtime indicators for this vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.