Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2025-43859

Description

h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in version 0.16.0. Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue.

POC

Reference

No PoCs from references.

Github

- https://github.com/11notes/docker-paperless-ngx

- https://github.com/ARPSyndicate/cve-scores

- https://github.com/HasnainKousar/is601_module14

- https://github.com/cloudsmith-io/rego-recipes

- https://github.com/dderyldowney/afs_fastapi

- https://github.com/dodo13114arch/mistralocr-pdf2md-translator

- https://github.com/runwhen-contrib/helm-charts

- https://github.com/tanjiti/sec_profile