Duplicate Host header handling in the python‑hyper h2 library allows a crafted HTTP/2 request to contain more than one Host header, which the library unintentionally forwards to the consuming application. When the consumer downgrades the request to HTTP/1.1, the duplicate headers persist and provide a request‑smuggling primitive. The primary impact is the ability for an attacker to send a request that is interpreted differently by intermediary proxies and the target application, potentially bypassing access controls or modifying request routing. The weakness is classified as CWE‑444, Duplicate HTTP Header.

Applications that depend on the python‑hyper h2 library version 4.4.0 or earlier are vulnerable. This includes any service or framework that uses h2 for HTTP/2 support and may subsequently downgrade requests to HTTP/1.1. The vulnerability exists regardless of the host environment, as long as the vulnerable library version is in use.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score is not available, suggesting that exploitation data is currently unknown or unlikely. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, with an attacker able to send a specially crafted HTTP/2 request to any service that accepts such traffic. No public exploit demonstrates use, but the smuggling capability poses a non‑negligible risk of compromising request integrity.