Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-847f-9342-265h

Опубликовано: 25 авг. 2025
Источник: github
Github: Прошло ревью
CVSS4: 6.9

Описание

h2 allows HTTP Request Smuggling due to illegal characters in headers

Summary

HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.

Пакеты

Наименование

h2

pip
Затронутые версииВерсия исправления

< 4.3.0

4.3.0

EPSS

Процентиль: 20%
0.00062
Низкий

6.9 Medium

CVSS4

Дефекты

CWE-93

Связанные уязвимости

ubuntu
12 дней назад

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.

CVSS3: 5.3
redhat
12 дней назад

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.

nvd
12 дней назад

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.

debian
12 дней назад

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior t ...

EPSS

Процентиль: 20%
0.00062
Низкий

6.9 Medium

CVSS4

Дефекты

CWE-93