Skip to content
OpenAdvisories
Medium DLA-4290-1 1 CVE

python-h2 - security update

Published Sep 2, 2025 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 python-h2 4.0.0-3+deb11u1

Vulnerabilities 1

  • Medium 6.9
    CVE-2025-57804

    h2 allows HTTP Request Smuggling due to illegal characters in headers

    h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrad…

    python-hyper h2 airflow-3 airflow-3-bitnami-compat Debian Ubuntu Wolfi PyPI