Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| h2 | pip | <= 4.4.0 | 4.4.1 |
Miggo AIRoot Cause AnalysisThe vulnerability allows for HTTP request smuggling due to the acceptance of multiple 'Host' headers in HTTP/2 requests. The provided patch for CVE-2026-71554 (GHSA-6hr6-w5qg-qmwg) clearly shows that the _validate_host_authority_header function in src/h2/utilities.py was modified to address this issue. Before the patch, this function would iterate over headers and would not flag the presence of more than one 'Host' header. An attacker could exploit this by sending a crafted HTTP/2 request with duplicate 'Host' headers. If a downstream proxy or server downgrades this request to HTTP/1.1, the resulting plaintext request would contain multiple 'Host' headers, which can be interpreted in different ways by different systems, leading to request smuggling. The patch introduces a check that raises a ProtocolError if a 'Host' header is encountered after one has already been processed, effectively mitigating the vulnerability. Therefore, the _validate_host_authority_header function is the specific location of the vulnerability.
_validate_host_authority_headersrc/h2/utilities.py