[GHSA] GHSA-6hr6-w5qg-qmwg (medium) — h2: Duplicate Host header could facilitate request smuggling

GHSA-6hr6-w5qg-qmwg Severity: medium CVE: CVE-2026-71554

h2: Duplicate Host header could facilitate request smuggling

### Impact h2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggli