How severe is CVE-2025-57804?

CVE-2025-57804 has a CVSS 4.0 base score of 6.9, rated medium severity.

Is CVE-2025-57804 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (73rd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2025-57804?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-57804 have an EU (EUVD) identifier?

Yes. CVE-2025-57804 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-28631.

When was CVE-2025-57804 published?

CVE-2025-57804 was published on 2025-08-25 and last updated on 2026-06-17.

CVE-2025-57804

CVE-2025-57804 is a medium-severity vulnerability with a CVSS 4.0 base score of 6.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-93.

Key facts

Severity: Medium (CVSS 4.0 base score 6.9)
EPSS exploit prediction: 2% (73rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-28631
Weakness: CWE-93
Published: 2025-08-25
Last modified: 2026-06-17

Description

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.

Frequently asked questions

What is CVE-2025-57804?: h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to HTTP/1.1 without properly validating header names/values, enabling attackers to manipulate request boundaries and bypass security controls. This issue has been patched in version 4.3.0.
How severe is CVE-2025-57804?: CVE-2025-57804 has a CVSS 4.0 base score of 6.9, rated medium severity.
Is CVE-2025-57804 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (73rd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-57804?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-57804 have an EU (EUVD) identifier?: Yes. CVE-2025-57804 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-28631.
When was CVE-2025-57804 published?: CVE-2025-57804 was published on 2025-08-25 and last updated on 2026-06-17.

References

Other CWE-93 (CRLF Injection) vulnerabilities

CVE-2024-51501 — Critical (CVSS 10.0): Refit is an automatic type-safe REST library for .NET Core, Xamarin and .NET The various header-related Refit…
CVE-2026-45372 — Critical (CVSS 9.9): cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when cpp-httplib's…
CVE-2026-11362 — Critical (CVSS 9.8): DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not…
CVE-2025-40671 — Critical (CVSS 9.3): SQL injection vulnerability in AES Multimedia's Gestnet v1.07. This vulnerability allows an attacker to retrieve,…
CVE-2026-11373 — Critical (CVSS 9.1): Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Client is a client for…
CVE-2026-50638 — Critical (CVSS 9.1): Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd…

Browse all CWE-93 (CRLF Injection) vulnerabilities →