HTTP/2 Request Splitting Vulnerability in Python-h2 Package
Summary
UBUNTU-CVE-2025-57804: h2 is a pure-Python implementation of a HTTP/2 protocol stack. Affects python-h2 versions 3.0.1-1 – 3.0.1-3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-h2 package is a pure-Python implementation of the HTTP/2 protocol stack, designed to facilitate communication over the web using the HTTP/2 standard. It is widely used in applications that require efficient and modern web communication. However, prior to version 4.3.0, the package was susceptible to a critical vulnerability that could allow attackers to exploit the protocol's handling of requests, leading to potential security breaches.
Vulnerability Detail
The vulnerability, identified as CVE-2025-57804, arises from an HTTP/2 request splitting flaw that enables attackers to perform request smuggling attacks. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names and values. By injecting CRLF (Carriage Return Line Feed) characters into headers, attackers can manipulate request boundaries, bypass security controls, and potentially compromise the integrity of the application. The issue has been patched in version 4.3.0 of the python-h2 package.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advisable to avoid downgrading HTTP/2 requests to HTTP/1.1 without proper validation of headers. Implementing strict validation checks on incoming requests can help mitigate the risk until the package is updated.
Conclusion
The python-h2 package has a critical vulnerability that can lead to serious security issues if not addressed. It is crucial to update to version 4.3.0 or later to protect your application from potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python-h2 →
FAQ
CVE-2025-57804 is a vulnerability in the python-h2 package that allows for HTTP/2 request splitting, potentially leading to request smuggling attacks.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If exploited, this vulnerability can allow attackers to manipulate request boundaries, bypass security controls, and potentially compromise sensitive data.
You can update the python-h2 package by running the command: 'sudo apt-get update && sudo apt-get install python-h2=4.3.0' in your terminal.
Yes, implementing strict validation checks on incoming requests can help mitigate the risk of exploitation until the package is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-h2.
