Threats affecting pkg:pypi/h2

python-hyper h2 versions up to and including 4.4.0 have a vulnerability where HTTP/2 request header blocks containing multiple Host headers are accepted and forwarded to the application. When the consumer downgrades HTTP/2 to HTTP/1.1, this results in two Host header lines in the HTTP/1.1 request, enabling HTTP request smuggling. This issue is resolved in version 4.4.1.

A vulnerability in h2 prior to version 4.3.0 allows HTTP request smuggling via injection of CRLF characters into headers during HTTP/2 to HTTP/1.1 downgrade. This improper validation of header names and values enables attackers to manipulate request boundaries and potentially bypass security controls.