Vulnerability in Python-Hyper H2
CVE-2025-57804
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.
Vulnerability class: CRLF Injection
EPSS: 0.017 (76.2th percentile) — read the EPSS interpretation.
Affected products
- Python-hyper H2 — versions < 4.3.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2025-57804?
- CVE-2025-57804 is a vulnerability in Python-Hyper H2, classified under CRLF Injection. Published 2025-08-25.
- Is CVE-2025-57804 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.