CVE-2025-43859 h11 accepts some malformed Chunked-Encoding bodies
Attackers can perform request smuggling by exploiting lenient chunked-encoding parsing in the h11 library when used with a vulnerable proxy.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-43859?
CVE-2025-43859 is a critical vulnerability in python-hyper h11, published on 24 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in version 0.16.0. Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue.
Weakness: CWE-444
Which versions are affected by CVE-2025-43859?
3 open source packages ship an affected version, including h11.
| Package | Affected | Fixed in |
|---|---|---|
h11 PyPI | All versions | 0.16.0 |
h11 PyPI | All versions | 0.16.0 |
h11 PyPI | All versions | 0.16.0 |
Linux distribution packages (19)
python-h11 Red Hat:openstack:17.1::el9 | All versions | 0:0.12.0-2.1.el9ost |
python3-h11 Red Hat:openstack:17.1::el9 | All versions | 0:0.12.0-2.1.el9ost |
python-h11 Red Hat:openstack:18.0::el9 | All versions | 0:0.12.0-4.el9ost |
python3-h11 Red Hat:openstack:18.0::el9 | All versions | 0:0.12.0-4.el9ost |
python-h11 SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 0.14.0-150400.9.6.1 |
python-h11 SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 0.14.0-150400.9.6.1 |
python-h11 SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 0.14.0-150400.9.6.1 |
python-h11 SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 0.14.0-150400.9.6.1 |
python-h11 SUSE:Linux Enterprise Module for Python 3 15 SP6 | All versions | 0.14.0-150400.9.6.1 |
python-h11 SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 0.14.0-150400.9.6.1 |
python-h11 SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 0.14.0-150400.9.6.1 |
python-h11 SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 0.14.0-150400.9.6.1 |
python-h11 SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 0.14.0-150400.9.6.1 |
python-h11 SUSE:Linux Micro 6.0 | All versions | 0.16.0-1.1 |
python-httpcore SUSE:Linux Micro 6.0 | All versions | 0.16.3-7.1 |
python-h11 SUSE:Linux Micro 6.1 | All versions | 0.16.0-slfo.1.1_1.1 |
python-httpcore SUSE:Linux Micro 6.1 | All versions | 0.16.3-slfo.1.1_2.1 |
python-h11 openSUSE:Leap 15.6 | All versions | 0.14.0-150400.9.6.1 |
python-h11 openSUSE:Tumbleweed | All versions | 0.16.0-1.1 |
How do I fix CVE-2025-43859?
Upgrade h11 to 0.16.0 or later.
Is CVE-2025-43859 being exploited?
There is no known exploitation of CVE-2025-43859 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-MQ93716, CLEANSTART-2026-UA31108, CLSA-2026-1767571924, CLSA-2026-1790929139, DEBIAN-CVE-2025-43859, GHSA-vqfr-h8mv-ghfj and 14 more.