Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-07 | 7 | Disclosure4PoC3 |
| 2026-08-08 | 1 | Patch1 |
CVE-2026-71554 h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, a… https://www.cve.org/CVERecord?id=CVE-2026-71554
Post summary
CVE‑2026‑71554 affects the h2 pure‑Python HTTP/2 library (versions ≤4.4.0) and allows multiple Host headers in request blocks, potentially leading to protocol behavior issues.
Finally, my first CVE got assigned CVE-2026-71554 h2 ≤4.4.0 (pure-Python HTTP/2 stack) accepts duplicate Host Headers and forwards all of them downstream. When HTTP/2 is downgraded to HTTP/1.1 this becomes a request smuggling primitive. #CVE #RequestSmuggling #BugBounty #hacking
Post summary
A new CVE (CVE‑2026‑71554) has been assigned to the h2 pure‑Python HTTP/2 stack, detailing that duplicate Host headers can be forwarded downstream and become a request‑smuggling vector when HTTP/2 is downgraded to HTTP/1.1.
Finally, my first CVE got assigned CVE-2026-71554 h2 ≤4.4.0 (pure-Python HTTP/2 stack) accepts duplicate Host headers and forwards all of them downstream. When HTTP/2 is downgraded to HTTP/1.1 this becomes a request smuggling primitive. #CVE #RequestSmuggling #BugBounty #hacking
Post summary
The tweet announces the new CVE‑2026-71554 for a pure‑Python HTTP/2 stack that allows duplicate Host headers, creating a request smuggling vector when downgraded to HTTP/1.1. No PoC, exploit, or patch details are provided.
🌐 Python HTTP/2 library vulnerable to request smuggling CVE-2026-71554 affects the Python h2 HTTP/2 stack through version 4.4.0. The library accepts multiple Host headers. When HTTP/2 traffic is downgraded to HTTP/1.1, this behavior can create a request-smuggling primitive. ✅ Fixed in 4.4.1. 🔎 Source: Tenable / GitHub Security Advisory. #Python #HTTP2 #RequestSmuggling #CVE #CyberSecurity
Post summary
CVE-2026-71554 affects Python h2 HTTP/2 stack, allowing request smuggling via multiple Host headers during downgrade to HTTP/1.1, and the issue is fixed in version 4.4.1.
Released PoC for CVE-2026-71554 h2 duplicate Host header request smuggling primitive. Affects h2 <= 4.4.0, fixed in 4.4.1. Stealth variant bypasses :authority validation backend sees evil.attacker while h2 validated good.internal https://github.com/SunandM/poc-h2-CVE-2026-71554/ @TenableSecurity @rapid7
Post summary
A PoC for CVE‑2026‑71554, an H2 duplicate host header request smuggling vulnerability fixed in version 4.4.1, has been released and linked via GitHub.
Released PoC for CVE-2026-71554 h2 duplicate Host header request smuggling primitive. Affects h2 <= 4.4.0, fixed in 4.4.1. Stealth variant bypasses :authority validation backend sees evil.attacker while h2 validated good.internal https://github.com/SunandM/poc-h2-CVE-2026-71554/ @TenableSecurity @rapid7
Post summary
The text announces a released PoC for CVE-2026-71554, a duplicate Host header request smuggling flaw in h2, provides a GitHub link to the code, and notes that the issue is fixed in version 4.4.1.
@CVEnew Released PoC for CVE-2026-71554 h2 duplicate Host header request smuggling primitive. Affects h2 <= 4.4.0, fixed in 4.4.1. Stealth variant bypasses :authority validation backend sees evil.attacker while h2 validated good.internal. https://github.com/SunandM/poc-h2-duplicate-host #CVE @TenableSecurity
Post summary
A proof‑of‑concept for CVE-2026-71554, an h2 host‑header request smuggling vulnerability fixed in 4.4.1, has been released, including a stealth bypass variant.
🚨*CVE* CVE-2026-71554 h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, a… https://www.cve.org/CVERecord?id=CVE-2026-71554 ----- Traducción: CVE-2026-71554 h2 … http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑71554, detailing a flaw in the pure‑Python h2 HTTP/2 stack that allows multiple Host headers in a request.