Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

python-hyper/h2

              master @ 1cd9ce0
            

Fixes

CVEs

HIGH

Peak severity

Highlights

HTTP Request Smuggling: 3 prior fixes. Scrutinize any change in this area.

src/h2/utilities.py: most-fixed (3 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

HTTP Request Smuggling: Inadequate validation of HTTP/2 header names and values allows attackers to inject forbidden characters (such as CR, LF, or null bytes) or empty header names. When the library is integrated with HTTP/1.1 downstreams, these smuggled headers can corrupt request boundaries, as highlighted by CVE-2025-57804.

Denial of Service: Failing to enforce the correct order of incoming frames (such as processing DATA frames before headers) leads to undefined stream state transitions and potentially crashes the connection. Strict ProtocolError raising is required on invalid state progressions.