Skip to content
Fencer Vulns
critical 9.1

CVE-2025-43859 json

h11 accepts some malformed Chunked-Encoding bodies

published 2025-04-24 18 mo ago modified 2026-10-27 12 d ago also GHSA-vqfr-h8mv-ghfj , PYSEC-2026-348 , EUVD-2025-11981

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in version 0.16.0. Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue.

Patch / fix

  • pypi h11 0.16.0
  • python-h11 Debian 12 0.14.0-1.1~deb12u1
  • python-h11 Debian 14, Debian 13 0.14.0-1.1

debian advisories DEBIAN-CVE-2025-43859

  • python-h11 Ubuntu 24.04 LTS 0.14.0-1ubuntu0.24.04.1

ubuntu advisories UBUNTU-CVE-2025-43859

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-h11 openstack 17.1 0.12.0-2.1.el9ost
  • python3-h11 openstack 17.1 0.12.0-2.1.el9ost
  • python-h11 openstack 18.0 0.12.0-4.el9ost
  • python3-h11 openstack 18.0 0.12.0-4.el9ost

red hat advisories RHSA-2025:7536RHSA-2025:7535

  • python-h11 Linux Micro 6.0 0.16.0-1.1
  • python-httpcore Linux Micro 6.0 0.16.3-7.1
  • python-httpcore Linux Micro 6.1 0.16.3-slfo.1.1_2.1
  • python-h11 Linux Micro 6.1 0.16.0-slfo.1.1_1.1
  • python-h11 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +7 more 0.14.0-150400.9.6.1

suse advisories SUSE-SU-2025:20331-1SUSE-SU-2025:20330-1SUSE-SU-2025:1430-1

  • python-h11 openSUSE Tumbleweed 0.16.0-1.1

opensuse advisories openSUSE-SU-2025:15032-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-43859 updated cvss 7.4

h11: h11 accepts some malformed Chunked-Encoding bodies

  • Red Hat OpenShift Lightspeed openshift-lightspeed-tech-preview/lightspeed-service-api-rhel9
    affected: workaround, no fix available “Ensure any applications using h11 are behind a correctly configured reverse proxy will prevent exploitation of this flaw.”
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-25/ee-supported-rhel9, ansible-automation-platform-24/platform-resource-runner-rhel8, ansible-automation-platform-25/platform-resource-runner-rhel9
    affected: workaround, no fix available, no fix planned “Ensure any applications using h11 are behind a correctly configured reverse proxy will prevent exploitation of this flaw.”
  • Red Hat Enterprise Linux AI (RHEL AI) rhelai1/bootc-amd-rhel9, rhelai1/bootc-intel-rhel9, rhelai1/bootc-nvidia-rhel9, rhelai1/bootc-azure-amd-rhel9, rhelai1/instructlab-amd-rhel9, rhelai1/bootc-aws-nvidia-rhel9, +5 more
    affected: workaround, no fix available “Ensure any applications using h11 are behind a correctly configured reverse proxy will prevent exploitation of this flaw.”
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 ansible-automation-platform-24/lightspeed-rhel8 2.4.250225-12
    fixed: vendor fix “Ensure any applications using h11 are behind a correctly configured reverse proxy will prevent exploitation of this flaw.” RHSA-2025:8615
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 ansible-automation-platform-25/ee-supported-rhel8 1.0.0-1016, ansible-automation-platform-25/lightspeed-rhel8 2.5.250528-1, ansible-automation-platform-25/lightspeed-chatbot-rhel8 2.5.250528-1 Red Hat Ansible Automation Platform 2.5 for RHEL 9 ansible-automation-platform-25/ee-supported-rhel9 1.0.0-1015, ansible-automation-platform-25/ee-cloud-services-rhel9 1.0.0-309
    fixed: vendor fix “Ensure any applications using h11 are behind a correctly configured reverse proxy will prevent exploitation of this flaw.” RHSA-2025:8221
  • Red Hat OpenStack Platform 17.1 python-h11 0.12.0-2.1.el9ost, python3-h11 0.12.0-2.1.el9ost
    fixed: vendor fix “Ensure any applications using h11 are behind a correctly configured reverse proxy will prevent exploitation of this flaw.” RHSA-2025:7536
  • Red Hat OpenStack Services on OpenShift 18.0 python-h11 0.12.0-4.el9ost, python3-h11 0.12.0-4.el9ost
    fixed: vendor fix “Ensure any applications using h11 are behind a correctly configured reverse proxy will prevent exploitation of this flaw.” RHSA-2025:7535
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/lightspeed-rhel8, ansible-automation-platform-25/ee-supported-rhel8 Red Hat Ansible Automation Platform 2.4 for RHEL 8 ansible-automation-platform-24/hub-rhel8 4.9.4-1, ansible-automation-platform-24/ee-29-rhel8 1.0.0-441, ansible-automation-platform-24/hub-web-rhel8 4.9.4-1, ansible-automation-platform-24/de-minimal-rhel8 1.0.8-9, ansible-automation-platform-24/controller-rhel8 4.5.23-2, ansible-automation-platform-24/de-supported-rhel8 1.0.8-8, +15 more Red Hat Ansible Automation Platform 2.4 for RHEL 9 ansible-automation-platform-24/de-minimal-rhel9 1.0.8-10, ansible-automation-platform-24/de-supported-rhel9 1.0.8-7, ansible-automation-platform-24/ee-minimal-rhel9 1.0.0-920, ansible-automation-platform-24/ee-supported-rhel9 1.0.0-1031, ansible-automation-platform-24/ansible-builder-rhel9 3.0.1-139, ansible-automation-platform-24/ansible-python-base-rhel9 1.0.0-761, +1 more Red Hat Ansible Automation Platform 2.5 for RHEL 8 ansible-automation-platform-25/hub-rhel8 4.10.4-10, ansible-automation-platform-25/hub-web-rhel8 4.10.4-9, ansible-automation-platform-25/receptor-rhel8 1.5.5-4, ansible-automation-platform-25/controller-rhel8 4.6.13-9, ansible-automation-platform-25/de-minimal-rhel8 1.1.6-10, ansible-automation-platform-25/ee-minimal-rhel8 1.0.0-912, +24 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 ansible-automation-platform-25/de-minimal-rhel9 1.1.6-9, ansible-automation-platform-25/ee-minimal-rhel9 1.0.0-913, ansible-automation-platform-25/de-supported-rhel9 1.1.6-10, ansible-automation-platform-25/ansible-builder-rhel9 3.1.0-243, ansible-automation-platform-25/ansible-python-base-rhel9 1.0.0-759, ansible-automation-platform-25/ansible-python-toolkit-rhel9 1.0.0-711
    not affected: vulnerable code not present
show 3 more
  • Red Hat Enterprise Linux AI (RHEL AI) rhelai1/ui-rhel9, rhelai1/docling-serve-rhel9
    not affected: component not present
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-model-registry-rhel8
    not affected: vulnerable code not present
  • Red Hat Satellite 6 python-h11
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
18 mo ago

Exploit prediction

0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
OSV 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
pypi h11
<0.16.0
0.16.0

Affected products

  • python-hyper h11

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.