python-hyper CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM python-hyper CVE published 2026-08-06

CVE-2026-71554

CVE-2026-71554 is a vulnerability in the h2 pure-Python implementation of the HTTP/2 protocol stack. The issue allows for request smuggling when downgrading from HTTP/2 to HTTP/1.1. This occurs because versions up to and including 4.4.0 accept request header blocks with multiple Host headers, which are then forwarded to the consuming application. The vulnerability is fixed in version 4.4.1.