CVE-2025-43859: python-hyper h11 HTTP Request/Response Smuggling
CVSS: 9.1v3.1CriticalDeferred
AliasesSUSE-SU-2025:1430-1SUSE-SU-2025:20330-1SUSE-SU-2025:20331-1GHSA-vqfr-h8mv-ghfjPYSEC-2026-348RHSA-2025:7535RHSA-2025:7536UBUNTU-CVE-2025-43859USN-7503-1DEBIAN-CVE-2025-43859CGA-2694-8vxh-9965CGA-2mgc-f44q-f4cvCGA-34fj-2vc8-jq7vCGA-38cq-cjx5-pxv9CGA-484m-wxgm-8x83CGA-55h9-8fxp-44x7CGA-5c77-wv72-hjmxCGA-65r7-v7xg-5wmgCGA-65rr-pc6j-28f6CGA-7hqm-fvv7-3qr7CGA-7j2f-4q84-cx44CGA-9pv2-5jfq-v6jvCGA-c2jq-8wvc-3j7gCGA-ff7c-h35v-4g2jCGA-frw6-cpxq-3797CGA-g296-h4g4-3575CGA-g465-4g24-cvg2CGA-gj38-r45g-vgq8CGA-hmr8-cqx6-66rhCGA-j446-598r-vfv2CGA-j7hr-gp5g-hfwcCGA-jwx3-v7fh-27q7CGA-m3vr-vv4c-3354CGA-m7j7-cw6v-qf45CGA-mj4v-w6gj-vxfmCGA-mv4f-43wv-x88jCGA-p3h3-xcr7-v645CGA-q6vg-xm7c-j6f5CGA-qc3v-pgfq-p854CGA-qfx3-3mrj-687rCGA-rcw3-gh3h-g3vwCGA-v7qx-359m-j99mCGA-w3pc-rf46-2673CGA-x4cm-whj7-93qcCGA-xffm-6q4m-m77cCGA-xx5w-p233-25xropenSUSE-SU-2025:15032-1CGA-2gjj-gg3f-jx34CGA-2m3p-gh6q-mcmpCGA-32jq-89q3-7pq5CGA-c3jm-pcw2-hv74CGA-cmpr-wc35-p489CGA-cxf7-5m79-ch58CGA-g524-3xp4-f35jCGA-p2r7-2xh7-8xcrCGA-rmw7-9wfw-mxmx
Published 24-04-2025Last modified 24-04-2025
Vulnerability summary
CVE-2025-43859 is a critical (CVSS 9.1) HTTP Request/Response Smuggling vulnerability in python-hyper h11. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.8% of scored vulnerabilities.
CVSS score
9.1/10
010
Critical · v3.1 (CVE.org)EPSS score
0.58%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 7Timeline
- 24-04-2025PublishedVulnerability first disclosed.
- 24-04-2025Last modifiedVulnerability information updated.
Description
h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in version 0.16.0. Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue.
CVSS metrics
8 scores · 8 sources · 1 versionCritical 9.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NSources8 sources · 7.4–9.1
- OSV · PypiEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · Red hatEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
0.00 pp
From 0.58% on 18-09-2026
18-09-202618-10-2026
EPSS score0.58%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard24 products
- airflow< 2.10.5-r43
- airflow-bitnami-compat< 2.10.5-r43
- checkov< 3.2.432-r0
- jupyter-base-notebook< 7.4.1-r1
- jupyter-docker-base< 999.9.9_git20260925-r0
Wolfi19 products
- airflow< 2.10.5-r43
- airflow-bitnami-compat< 2.10.5-r43
- checkov< 3.2.432-r0
- jupyter-base-notebook< 7.4.1-r1
- jupyter-docker-base< 999.9.9_git20260925-r0
Suse13 products
- python-h11&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 0.14.0-150400.9.6.1
- python-h11&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 0.14.0-150400.9.6.1
- python-h11&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 0.14.0-150400.9.6.1
- python-h11&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 0.14.0-150400.9.6.1
- python-h11&distro=SUSE Linux Enterprise Module for Python 3 15 SP6< 0.14.0-150400.9.6.1
Opensuse2 products
- python-h11&distro=openSUSE Leap 15.6< 0.14.0-150400.9.6.1
- python-h11&distro=openSUSE Tumbleweed< 0.16.0-1.1
Redhat2 products
- python-h11< 0:0.12.0-4.el9ost | < 0:0.12.0-2.1.el9ost
- python3-h11< 0:0.12.0-4.el9ost | < 0:0.12.0-2.1.el9ost
Debian1 product
- python-h11< 0.14.0-1.1~deb12u1 | < 0.14.0-1.1
PyPI1 product
- h11< 0.16.0
Python-hyper1 product
- h11< 0.16.0
Ubuntu1 product
- python-h11< 0.14.0-1ubuntu0.24.04.1
9 vendors · 64 products
References
23 links- github.com/python-hyper/h11/security/advisories/GHSA-vqfr-h8mv-ghfjX Refsource CONFIRMWEBARTICLEREPORTAdvisory
- github.com/python-hyper/h11/commit/114803a29ce50116dc47951c690ad4892b1a36edX Refsource MISCWEBARTICLEREPORTFIX
- github.com/python-hyper/h11PACKAGE
- pypi.org/project/h11PACKAGE
