A vulnerability in h2 prior to version 4.3.0 allows HTTP request smuggling via injection of CRLF characters into headers during HTTP/2 to HTTP/1.1 downgrade. This improper validation of header names and values enables attackers to manipulate request boundaries and potentially bypass security controls.