CVE-2025-57804
Medium
Description
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.
SeverityMedium
CVSS6.9
Exploit probability—
ProductH2
PublishedAug 25, 2025
First seenAug 25, 2025
Weakness typeCWE-93CWE-93
How to fix
Update
- h24.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| h2PyPI | v < 4.3.0 | 4.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.