HTTP/2 Request Splitting Vulnerability in python-h2 Package
Summary
DEBIAN-CVE-2025-57804: h2 is a pure-Python implementation of a HTTP/2 protocol stack. Affects python-h2 versions < 4.0.0-3+deb11u1. Fixed in 4.0.0-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-h2 package is a pure-Python implementation of the HTTP/2 protocol stack, designed to facilitate the development of applications that require HTTP/2 support. It allows developers to leverage the advanced features of HTTP/2, such as multiplexing and header compression, to enhance web application performance. However, prior to version 4.3.0, the package was susceptible to a critical vulnerability that could compromise the integrity of HTTP requests.
Vulnerability Detail
The vulnerability stems from an HTTP/2 request splitting flaw that allows attackers to perform request smuggling attacks. This occurs when servers improperly downgrade HTTP/2 requests to HTTP/1.1 without validating header names and values. By injecting CRLF (Carriage Return Line Feed) characters into headers, attackers can manipulate request boundaries, potentially bypassing security controls and leading to unauthorized actions or data exposure.
How To Fix
Minimum fixed version
4.0.0-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-h2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement strict validation of incoming headers to prevent CRLF injection. However, this is not a complete solution and updating the package is strongly recommended.
Conclusion
The python-h2 package was found to have a significant vulnerability related to HTTP/2 request splitting, which could lead to serious security risks. It is crucial for users to update to the latest version to mitigate these risks and ensure the integrity of their applications.
See every vulnerability recorded for python-h2 →
FAQ
The vulnerability is an HTTP/2 request splitting flaw that allows for request smuggling attacks through CRLF injection in headers.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If exploited, this vulnerability could allow attackers to bypass security controls, manipulate requests, and potentially gain unauthorized access to sensitive data.
Yes, the vulnerability has been patched in version 4.3.0 of the python-h2 package.
If immediate updates are not possible, implement strict validation of incoming headers as a temporary workaround until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-h2.
