Amazon Linux 2023 Security Advisory: ALAS2023-2025-1181
Advisory Released Date: 2025-09-15
Advisory Updated Date: 2025-09-15
Severity:
Medium
Issue Overview:
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0. (CVE-2025-57804)
Affected Packages:
python-h2
Issue Correction:
Run dnf update python-h2 --releasever 2023.8.20250915 or dnf update --advisory ALAS2023-2025-1181 --releasever 2023.8.20250915 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
noarch:
python3-h2-4.0.0-2.amzn2023.0.4.noarch
src:
python-h2-4.0.0-2.amzn2023.0.4.src