Vulnerabilities for h2

First version without a known vulnerability: 4.4.1

Details

• GHSA-6hr6-w5qg-qmwg2026-08-06

  h2: Duplicate Host header could facilitate request smuggling

  Fixed in: 4.4.1

• GHSA-847f-9342-265h2025-08-25

  h2 allows HTTP Request Smuggling due to illegal characters in headers

  Fixed in: 4.3.0