GHSA-847f-9342-265h

h2 allows HTTP Request Smuggling due to illegal characters in headers

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-57804

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	h2	< 4.3.0	4.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.

References

External links from the advisory. They lead to third-party sites.

https://github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h web
https://nvd.nist.gov/vuln/detail/CVE-2025-57804 advisory
https://github.com/python-hyper/h2/commit/035e9899f95e3709af098f578bfc3cd302298e3a web
https://github.com/python-hyper/h2 package
https://lists.debian.org/debian-lts-announce/2025/09/msg00004.html web