HTTP/2 Request Splitting Vulnerability in python-h2 Package
Summary
CVE-2025-57804: h2 is a pure-Python implementation of a HTTP/2 protocol stack. Affects python-h2 across 2 version ranges.
< 4.0.0-3+deb11u1
< 035e9899f95e3709af098f578bfc3cd302298e3a
Fixed in 4.0.0-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-h2 package is a pure-Python implementation of the HTTP/2 protocol stack, designed to facilitate the development of applications that require HTTP/2 support. It provides essential features for managing HTTP/2 connections, including multiplexing, stream prioritization, and header compression. However, prior to version 4.3.0, it was vulnerable to an HTTP/2 request splitting issue that could be exploited by attackers.
Vulnerability Detail
The vulnerability arises from an improper handling of HTTP/2 requests when they are downgraded to HTTP/1.1. Attackers can exploit this flaw by injecting CRLF (Carriage Return Line Feed) characters into HTTP headers, leading to request smuggling attacks. This manipulation allows attackers to bypass security controls and potentially gain unauthorized access to sensitive data or perform malicious actions on behalf of legitimate users.
How To Fix
Minimum fixed version
4.0.0-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-h2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement strict validation of HTTP headers in your application to prevent the injection of CRLF characters. This may involve sanitizing input and rejecting requests that contain suspicious header formats.
Conclusion
The python-h2 package has a critical vulnerability that allows for HTTP/2 request splitting, posing significant security risks. It is essential to update to the patched version 4.3.0 or later to safeguard your applications. Additionally, utilizing tools like Vulert can help you monitor for vulnerabilities effectively.
See every vulnerability recorded for python-h2 →
FAQ
The vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers, which can lead to unauthorized access and manipulation of requests.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install additional tools.
All versions prior to 4.3.0 are affected by this vulnerability. It is crucial to update to version 4.3.0 or later to mitigate the risk.
If exploited, this vulnerability could allow attackers to bypass security measures, leading to data breaches, unauthorized actions, or service disruptions.
Yes, you can use the Vulert platform to monitor and receive alerts for open-source vulnerabilities in your applications in real-time.
Related vulnerabilities
Recent vulnerabilities recorded for python-h2.
