PT-2025-34706 · H2+2 · H2+2

·

CVE-2025-57804

·

Published

2025-08-23

·

Updated

2026-07-13

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: h2 versions prior to 4.3.0
Description: h2 is a pure-Python implementation of a HTTP/2 protocol stack. A request splitting issue allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.
Recommendations: Update to version 4.3.0 or later.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2026-02911
CLEANSTART-2026-AN24336
CLEANSTART-2026-FU07345
CLEANSTART-2026-KE11953
CLEANSTART-2026-NM83456
CLEANSTART-2026-QE89118
CVE-2025-57804
DLA-4290-1
ECHO-A060-6EE9-114C
GHSA-847F-9342-265H
OESA-2025-2250
OPENSUSE-SU-2025:15496-1
OPENSUSE-SU-2026:20122-1
PYSEC-2026-1435
SUSE-SU-2025:03199-1
SUSE-SU-2025:03273-1
SUSE-SU-2025_03273-1
SUSE-SU-2026:20187-1

Affected Products

Debian
Suse
H2