ByteOS Network

CVE Vulnerability Details :

CVE-2025-43859

PUBLISHED

More Info Official Page

Assigner-GitHub_M

Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa

Published At-24 Apr, 2025 | 18:15

Updated At-24 Apr, 2025 | 19:02

▼CVE Numbering Authority (CNA)

h11 accepts some malformed Chunked-Encoding bodies

h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in version 0.16.0. Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue.

Affected Products

Vendor

python-hyper

Product

h11

Versions

Affected

< 0.16.0

Problem Types

Type	CWE ID	Description
CWE	CWE-444	CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Metrics

Version	Base score	Base severity	Vector
3.1	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Hyperlink	Resource
https://github.com/python-hyper/h11/security/advisories/GHSA-vqfr-h8mv-ghfj	x_refsource_CONFIRM
https://github.com/python-hyper/h11/commit/114803a29ce50116dc47951c690ad4892b1a36ed	x_refsource_MISC

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References