CVE-2026-71554

Affected versions of the `h2` package are vulnerable to Request Smuggling due to improper handling of duplicate Host headers. The `h2` library accepts HTTP/2 request header blocks that contain multiple Host headers and forwards all of them to the consuming application, which may downgrade the request to HTTP/1.1, resulting in two Host headers in the request. An attacker can exploit this vulnerability by crafting requests with multiple Host headers, potentially bypassing security controls or routing requests to unintended destinations.