HTTP/2 Request Splitting Vulnerability in h2 by Python Software Foundation

CVE-2025-57804

What is CVE-2025-57804?

The h2 Python library, a pure-Python implementation of the HTTP/2 protocol, has a security vulnerability that allows for request splitting attacks. This occurs when an HTTP/2 request is improperly downgraded to HTTP/1.1 without sufficient validation of header values. Attackers can exploit this flaw by injecting CRLF (Carriage Return Line Feed) characters into request headers, thereby manipulating the request boundaries. This can lead to severe security implications including the bypassing of security controls. The vulnerability has been addressed in version 4.3.0, and it is crucial for users to update to this version to ensure their systems are secure.

References