CVE-2025-43859

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in version 0.16.0. Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-444

Affected software

No affected versions have been published.

Timeline

Published: Apr 24, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-43866.8Medtronic MyCareLink Patient Monitor has an internal serial interface, which allows an attacker with physical access to access a login promp CVE-2025-438607.6OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS)CVE-2025-438615.4ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 2f177dc, ManageWiki is vulnerable to reflected or stored CVE-2025-438627.6Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, CVE-2025-438639.8vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Par CVE-2025-438647.5React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch t CVE-2025-438658.2React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by addin CVE-2025-438667.5vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unles CVE-2025-43878.8The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validat CVE-2025-438738.7Successful exploitation of these vulnerabilities could allow an attacker to modify firmware and gain full access to the device.CVE-2025-438758.7Under certain circumstances a successful exploitation could result in access to the device.CVE-2025-438768.7Under certain circumstances a successful exploitation could result in access to the device.