Is there a bug in h2?

h2 allows HTTP Request Smuggling due to illegal characters in headers ### Summary HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Fixed in h2 4.3.0.

Is there a bug in h2?

h2 allows HTTP Request Smuggling due to illegal characters in headers ### Summary HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. Fixed in h2 4.3.0.

This package has limited bug data (2 entries). Check back later or see the package health page for the full signal.

h2 known bugs

pypi

2 known bugs in h2, with affected versions, fixes and workarounds. Sourced from upstream issue trackers.

View package health \u2192 Breaking changes \u2192

bugs

Known bugs

Severity	Affected	Fixed in	Title	Status	Source
medium	any	4.3.0	h2 allows HTTP Request Smuggling due to illegal characters in headers ### Summary HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.	fixed	osv:PYSEC-2026-1435
medium	any	4.3.0	h2 allows HTTP Request Smuggling due to illegal characters in headers ### Summary HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.	fixed	osv:GHSA-847f-9342-265h

API access

Get this data programmatically \u2014 free, no authentication.

curl https://depscope.dev/api/bugs/pypi/h2