https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 08:41:20 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-02911 bdu:2026-02911 https://cve.radiocsirt.org/vuln/bdu:2026-02911 https://cve.radiocsirt.org/vuln/bell-cve-2025-57804 <p><strong>Affected:</strong> Alpaquita:23: py3-h2, Alpaquita:25: py3-h2, Alpaquita:stream: py3-h2</p> <p><strong>Affected:</strong> Alpaquita:23: py3-h2, Alpaquita:25: py3-h2, Alpaquita:stream: py3-h2</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-57804 https://cve.radiocsirt.org/vuln/brew-bilix-cve-2025-57804 <p><strong>Affected:</strong> Homebrew: bilix</p> <p>### Summary</p> <p>HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.</p> <p><strong>Affected:</strong> Homebrew: bilix</p> <p>### Summary</p> <p>HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.</p> https://cve.radiocsirt.org/vuln/brew-bilix-cve-2025-57804 https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 https://cve.radiocsirt.org/vuln/euvd-2026-257576 EUVD-2026-257576 https://cve.radiocsirt.org/vuln/euvd-2026-257576 https://cve.radiocsirt.org/vuln/fkie_cve-2025-57804 <p>h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.</p> <p>h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-57804 https://cve.radiocsirt.org/vuln/ghsa-847f-9342-265h <p><strong>Affected:</strong> PyPI: h2</p> <p>### Summary</p> <p>HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.</p> <p><strong>Affected:</strong> PyPI: h2</p> <p>### Summary</p> <p>HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.</p> https://cve.radiocsirt.org/vuln/ghsa-847f-9342-265h https://cve.radiocsirt.org/vuln/oesa-2025-2250 <p><strong>Affected:</strong> openEuler:24.03-LTS: python-h2, openEuler:24.03-LTS-SP1: python-h2, openEuler:24.03-LTS-SP2: python-h2, openEuler:20.03-LTS-SP4: python-h2, openEuler:22.03-LTS-SP3: python-h2, openEuler:22.03-LTS-SP4: python-h2</p> <p>This repository contains a pure-Python implementation of a HTTP/2 protocol stack. It is written from the ground up to be embeddable in whatever program you choose to use, ensuring that you can speak HTTP/2 regardless of your programming paradigm. Security Fix(es):</p> <p>A vulnerability was found in python-hyper h2 up to 4.2.x (Programming Language Software) and classified as problematic.Using CWE to declare the problem leads to CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.Impacted is integrity.Upgrading to version 4.3.0 eliminates this vulnerability. Applying the patch 035e9899f95e3709af098f578bfc3cd302298e3a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-57804)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS: python-h2, openEuler:24.03-LTS-SP1: python-h2, openEuler:24.03-LTS-SP2: python-h2, openEuler:20.03-LTS-SP4: python-h2, openEuler:22.03-LTS-SP3: python-h2, openEuler:22.03-LTS-SP4: python-h2</p> <p>This repository contains a pure-Python implementation of a HTTP/2 protocol stack. It is written from the ground up to be embeddable in whatever program you choose to use, ensuring that you can speak HTTP/2 regardless of your programming paradigm. Security Fix(es):</p> <p>A vulnerability was found in python-hyper h2 up to 4.2.x (Programming Language Software) and classified as problematic.Using CWE to declare the problem leads to CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.Impacted is integrity.Upgrading to version 4.3.0 eliminates this vulnerability. Applying the patch 035e9899f95e3709af098f578bfc3cd302298e3a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-57804)</p> https://cve.radiocsirt.org/vuln/oesa-2025-2250 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15496-1 <p>python311-h2-4.3.0-1.1 on GA media</p> <p>python311-h2-4.3.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15496-1 https://cve.radiocsirt.org/vuln/pysec-2026-1435 <p><strong>Affected:</strong> PyPI: h2</p> <p>### Summary</p> <p>HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.</p> <p><strong>Affected:</strong> PyPI: h2</p> <p>### Summary</p> <p>HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1435 https://cve.radiocsirt.org/vuln/suse-su-2026:20187-1 <p>Security update for python-h2</p> <p>Security update for python-h2</p> https://cve.radiocsirt.org/vuln/suse-su-2026:20187-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-57804 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: python-h2, Ubuntu:20.04:LTS: python-h2, Ubuntu:22.04:LTS: python-h2, Ubuntu:24.04:LTS: python-h2, Ubuntu:25.10: python-h2, Ubuntu:26.04:LTS: python-h2</p> <p>h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: python-h2, Ubuntu:20.04:LTS: python-h2, Ubuntu:22.04:LTS: python-h2, Ubuntu:24.04:LTS: python-h2, Ubuntu:25.10: python-h2, Ubuntu:26.04:LTS: python-h2</p> <p>h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-57804