VYPR
← All advisories
Critical severity9.1OSV Advisory· Published Apr 24, 2025· Updated Apr 15, 2026

CVE-2025-43859

CVE-2025-43859

Description

h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in version 0.16.0. Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
h11PyPI
< 0.16.00.16.0

Affected products

70

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.