Skip to content
OpenAdvisories
Medium ALAS2023-2025-1181 1 CVE

Moderate: python-h2 security update (Amazon Linux 2023)

Published Sep 10, 2025 · Updated Sep 15, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-57804: h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2023 python3-h2 0:4.0.0-2.amzn2023.0.4

Vulnerabilities 1

  • Medium 6.9
    CVE-2025-57804

    h2 allows HTTP Request Smuggling due to illegal characters in headers

    h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrad…

    python-hyper h2 airflow-3 airflow-3-bitnami-compat Debian Ubuntu Wolfi PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-57804.html