chore(deps): update dependency h2 to v4.4.1 [security]

[renovate]

This PR contains the following updates:

Package	Update	Change	OpenSSF
h2	minor	==4.3.0 → ==4.4.1

---

h2: Duplicate Host header could facilitate request smuggling

CVE-2026-71554 / GHSA-6hr6-w5qg-qmwg

More information

Details

Impact

h2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444).

Patches

Patched and fixed in v4.4.1

Workarounds

Users of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack.

References

Similar to the previously disclosed and fixed duplicate content-length issue.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg
• https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6
• https://github.com/advisories/GHSA-6hr6-w5qg-qmwg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

h2: Duplicate Host header could facilitate request smuggling

CVE-2026-71554 / GHSA-6hr6-w5qg-qmwg

More information

Details

Impact

h2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444).

Patches

Patched and fixed in v4.4.1

Workarounds

Users of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack.

References

Similar to the previously disclosed and fixed duplicate content-length issue.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg
• https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6
• https://github.com/python-hyper/h2

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

python-hyper/h2 (h2)

v4.4.1

Compare Source

Bugfixes

• Performance improvement: remove consumed frames in-place from data buffer.
• Reject duplicate Host headers in request headers. Thanks to Sunand Mohan for the report.

v4.4.0

Compare Source

API Changes (Backward Incompatible)

• Support for Python 3.9 has been removed.
• Support for PyPy 3.9 has been removed.
• Stream.end_stream() now raises NoSuchStreamError or StreamClosedError exceptions, instead of a generic KeyError.
• Duplicate content-length headers with different values now raise ProtocolError.
  Previously, the first content-length header was accepted and later conflicting values were ignored. Thanks to Harshal Parekh for the report.
• Parse content-length headers according to RFC9110 grammar for numbers (1*DIGIT). Thanks to Arkadiusz Marta for the report.
• backfill from v4.3.0 Convert emitted events into Python dataclass, which introduces new constructors with required arguments.
  Instantiating these events without arguments, as previously commonly used API pattern, will no longer work.

API Changes (Backward Compatible)

• Support for Python 3.14 has been added.
• H2Connection.receive_data now accepts any byte-like object that
  implements the buffer protocol, such as bytes, bytearray, and
  memoryview. Existing bytes callers are unaffected.
• Align CONNECT pseudo-header validation with RFC 9113 s8.3 and RFC 8441 s4.
  Ordinary CONNECT now requires :method=CONNECT and :authority, and
  forbids :scheme/:path. Extended CONNECT (e.g., WebSocket) requires
  :scheme, :path, :authority plus :protocol. (PR #​1309)
• Fix incorrect substring matching of secure header in cookie and :method.

Bugfixes

• Fix to allow sending 0 bytes on a stream even if the flow control window is negative.
• Reject non-zero SETTINGS_ENABLE_PUSH values received from servers.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.