https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T08:42:03.154541+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-02911 bdu:2026-02911 2026-10-03T08:42:03.165672+00:00 bdu:2026-02911 https://cve.radiocsirt.org/vuln/bell-cve-2025-57804 BELL-CVE-2025-57804 2026-10-03T08:42:03.165703+00:00

Affected: Alpaquita:23: py3-h2, Alpaquita:25: py3-h2, Alpaquita:stream: py3-h2

 https://cve.radiocsirt.org/vuln/brew-bilix-cve-2025-57804 BREW-bilix-CVE-2025-57804 — h2 allows HTTP Request Smuggling due to illegal characters in headers 2026-10-03T08:42:03.165732+00:00

Affected: Homebrew: bilix

### Summary

HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.

 https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 Withdrawn: CLEANSTART-2026-AN24336 — Security fixes for CVE-2024-12797, CVE-2024-52303, CVE-2024-52304, CVE-2024-56201, CVE-2024-56326, CVE-2025-24023, CVE-… 2026-10-03T08:42:03.165757+00:00

Withdrawn by the publisher.

Affected: CleanStart: airflow-2

Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-257576 EUVD-2026-257576 2026-10-03T08:42:03.165784+00:00 EUVD-2026-257576 https://cve.radiocsirt.org/vuln/fkie_cve-2025-57804 fkie_cve-2025-57804 2026-10-03T08:42:03.165796+00:00

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.

 https://cve.radiocsirt.org/vuln/ghsa-847f-9342-265h GHSA-847f-9342-265h — h2 allows HTTP Request Smuggling due to illegal characters in headers 2026-10-03T08:42:03.165816+00:00

Affected: PyPI: h2

### Summary

HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.

 https://cve.radiocsirt.org/vuln/oesa-2025-2250 OESA-2025-2250 — python-h2 security update 2026-10-03T08:42:03.165835+00:00

Affected: openEuler:24.03-LTS: python-h2, openEuler:24.03-LTS-SP1: python-h2, openEuler:24.03-LTS-SP2: python-h2, openEuler:20.03-LTS-SP4: python-h2, openEuler:22.03-LTS-SP3: python-h2, openEuler:22.03-LTS-SP4: python-h2

This repository contains a pure-Python implementation of a HTTP/2 protocol stack. It is written from the ground up to be embeddable in whatever program you choose to use, ensuring that you can speak HTTP/2 regardless of your programming paradigm. Security Fix(es):

A vulnerability was found in python-hyper h2 up to 4.2.x (Programming Language Software) and classified as problematic.Using CWE to declare the problem leads to CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.Impacted is integrity.Upgrading to version 4.3.0 eliminates this vulnerability. Applying the patch 035e9899f95e3709af098f578bfc3cd302298e3a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-57804)

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15496-1 openSUSE-SU-2025:15496-1 — python311-h2-4.3.0-1.1 on GA media 2026-10-03T08:42:03.165874+00:00

python311-h2-4.3.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2026-1435 PYSEC-2026-1435 — h2 allows HTTP Request Smuggling due to illegal characters in headers 2026-10-03T08:42:03.165910+00:00

Affected: PyPI: h2

### Summary

HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.

 https://cve.radiocsirt.org/vuln/suse-su-2026:20187-1 SUSE-SU-2026:20187-1 — Security update for python-h2 2026-10-03T08:42:03.165942+00:00

Security update for python-h2

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-57804 UBUNTU-CVE-2025-57804 2026-10-03T08:42:03.165956+00:00

Affected: Ubuntu:18.04:LTS: python-h2, Ubuntu:20.04:LTS: python-h2, Ubuntu:22.04:LTS: python-h2, Ubuntu:24.04:LTS: python-h2, Ubuntu:25.10: python-h2, Ubuntu:26.04:LTS: python-h2

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.