Summary
Jeppe Bonde Weikop discovered that h11 incorrectly handled crafted HTTP
requests. A remote attacker could possibly use this issue to smuggle
malicious HTTP requests, which could potentially lead to security
control bypass and information leakage.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | python-h11 | 0.14.0-1ubuntu0.24.04.1 |
Vulnerabilities 1
-
Critical 9.1
h11 accepts some malformed Chunked-Encoding bodies
h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in versio…
References
-
report
https://ubuntu.com/security/CVE-2025-43859