CVE-2025-43859

Published Apr 24, 2025

Last updated 14 hours ago

Python

h11

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-43859 is a vulnerability found in h11, a Python implementation of HTTP/1.1, specifically in versions prior to 0.16.0. The vulnerability stems from a leniency in how h11 parses line terminators within chunked-coding message bodies. This can lead to request smuggling attacks under certain conditions. The vulnerability can be exploited when a buggy h11 implementation is paired with a misconfigured or buggy reverse proxy. The issue has been addressed in h11 version 0.16.0. Fixing either the h11 component or the proxy component can mitigate the risk.

Description: h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in version 0.16.0. Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue.
Source: security-advisories@github.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.1
Impact score: 5.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-444

Hype score: Not currently trending

Overview

AI description

Risk scores

CVSS 3.1

Weaknesses

Social media

References