Threats tagged 'ghsa-6hr6-w5qg-qmwg'

python-hyper h2 versions up to and including 4.4.0 have a vulnerability where HTTP/2 request header blocks containing multiple Host headers are accepted and forwarded to the application. When the consumer downgrades HTTP/2 to HTTP/1.1, this results in two Host header lines in the HTTP/1.1 request, enabling HTTP request smuggling. This issue is resolved in version 4.4.1.