PT-2025-34706 · H2+2 · H2+2

Sebastianosrt · Published 2025-08-23 · Updated 2026-06-03 · CVE-2025-57804

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: h2 versions prior to 4.3.0

Description: h2 is a pure-Python implementation of a HTTP/2 protocol stack. A request splitting issue allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.

Recommendations: Update to version 4.3.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-93

Related Identifiers

BDU:2026-02911

CVE-2025-57804

DLA-4290-1

ECHO-A060-6EE9-114C

GHSA-847F-9342-265H

OESA-2025-2250

OPENSUSE-SU-2025:15496-1

OPENSUSE-SU-2026:20122-1

SUSE-SU-2025:03199-1

SUSE-SU-2025:03273-1

SUSE-SU-2025_03273-1

SUSE-SU-2026:20187-1

Affected Products

Debian

Suse

H2

References · 38

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57804.json · Exploit
• https://osv.dev/vulnerability/OESA-2025-2250 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-57804 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-57804 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03199-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-57804 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15496-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03273-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02911 · Security Note
• https://osv.dev/vulnerability/DLA-4290-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0305SE38 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57804 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2025-57804 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-57804 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-847f-9342-265h · Vendor Advisory