CVE-2025-43859

{"id": "CVE-2025-43859", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2025-04-24T19:15:47.060", "references": [{"url": "https://github.com/python-hyper/h11/commit/114803a29ce50116dc47951c690ad4892b1a36ed", "source": "security-advisories@github.com"}, {"url": "https://github.com/python-hyper/h11/security/advisories/GHSA-vqfr-h8mv-ghfj", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in version 0.16.0. Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue."}, {"lang": "es", "value": "h11 es una implementaci\u00f3n de Python de HTTP/1.1. Antes de la versi\u00f3n 0.16.0, una tolerancia en el an\u00e1lisis de terminadores de l\u00ednea por parte de h11 en cuerpos de mensajes con codificaci\u00f3n fragmentada pod\u00eda provocar vulnerabilidades de contrabando de solicitudes en ciertas circunstancias. Este problema se ha corregido en la versi\u00f3n 0.16.0. Dado que su explotaci\u00f3n requiere la combinaci\u00f3n de h11 con errores y un proxy inverso con errores, la correcci\u00f3n de cualquiera de los componentes es suficiente para mitigar este problema."}], "lastModified": "2025-04-29T13:52:28.490", "sourceIdentifier": "security-advisories@github.com"}