InfoSecBulletin Cybersecurity for mankind
A critical vulnerability tracked as CVE-2025-43859 has been disclosed in h11, a minimalist, I/O-agnostic HTTP/1.1 protocol library written in Python. Rated CVSS 9.1, the flaw could enable request smuggling attacks in applications where h11 is paired with a misconfigured or buggy HTTP proxy.
“A leniency in h11’s parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions,” the h11 advisory warns.
Intel PC, laptop and server processors affected for 6 years: Report
CVSS 10.0 Flaw
Critical flaw in Siemens OZW Web Servers Enable Unauthenticated RCE
Microsoft Patch Tuesday May 2025: 72 flaws, 5 Actively Exploited Zero-Day
OTP glitch disrupted NID services across the country
Google to pay Texas $1.4 billion for location tracking practices
YouTube geo-blocks at least 4 Bangladeshi TV channels in India
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
In HTTP/1.1, chunked transfer encoding is used to send request or response bodies in variable-size segments. Each chunk is terminated by a CRLF sequence (\r\n). However, until version 0.14.0, h11 incorrectly accepted any two bytes instead of properly validating that the trailing bytes were exactly \r\n.This leniency by itself isn’t immediately dangerous. But when h11 is used behind a reverse proxy that misinterprets chunked encoding, inconsistencies arise. For example, the reverse proxy might read more bytes than it should by using a naive “read until end of line” function, resulting in h11 and the proxy interpreting the same bytestream differently.
“Any time two HTTP processors both accept the same string of bytes but interpret them differently, you have the conditions for a ‘request smuggling’ attack,” the h11 advisory notes.
A demonstrated example in the advisory shows how h11 could interpret a malformed chunked request as two separate HTTP requests, while a buggy proxy sees them as one combined request. If the second request contains sensitive headers (like Cookie: SESSION_KEY=abcdef…), the server may treat this as part of the first request, effectively leaking credentials or bypassing access controls.
This is particularly dangerous in environments where proxies are used to restrict access to protected endpoints.
One of the more severe illustrated attacks involves sending two HTTP requests from different users over the same connection. A vulnerable proxy could forward both to the backend server, which in turn interprets the second user’s credentials as part of the first request’s body.
“The server will then see the two concatenated requests, and interpret them as one request to /one whose body includes /two’s session key, potentially allowing one user to steal another’s credentials,” the advisory warns.
The issue has been fixed in h11 version 0.15.0. Developers using h11 are urged to upgrade immediately.
