p PatchFirst

CVE-2025-43859

CVE-2025-43859 · h11 accepts some malformed Chunked-Encoding bodies

This page contains facts from public vulnerability sources. Check the original advisory before updating.

h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in version 0.16.0. Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue.

CVSS 9.1 · Critical · EPSS 0.6% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • h11

    Versions
    • < 0.16.0: Affected

    No fix published

  • python-h11 Debian:12

    Versions
    • 0.14.0-1
    Affected ranges
    • ECOSYSTEM: < 0.14.0-1.1~deb12u1

    Update to 0.14.0-1.1~deb12u1

  • python-h11 Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.14.0-1.1

    Update to 0.14.0-1.1

  • python-h11 Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.14.0-1.1

    Update to 0.14.0-1.1

  • h11 PyPI

    Versions
    • 0.0.1
    • 0.10.0
    • 0.11.0
    • 0.12.0
    • 0.13.0
    • 0.14.0
    • 0.15.0
    • 0.5.0
    • 0.6.0
    • 0.7.0
    • 0.8.0
    • 0.8.1
    • 0.9.0
    Affected ranges
    • ECOSYSTEM: < 0.16.0

    Update to 0.16.0

  • python-h11 Ubuntu:24.04:LTS

    Versions
    • 0.14.0-1
    Affected ranges
    • ECOSYSTEM: < 0.14.0-1ubuntu0.24.04.1

    Update to 0.14.0-1ubuntu0.24.04.1

Original sources

Check your server →