BSD Portsh11 accepts some malformed Chunked-Encoding bodies
· CVE-2025-43859 · VuXML entry
h11 reports: h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in version 0.16.0. Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate …
Affected versions
- py39-h11, py310-h11, py311-h11, py312-h11 < 0.16.0
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | net/py-h11 | 0.14.0_1 | vulnerable since 2025-04-29 | |
| NetBSD | www/py-h11 | 0.16.0 | not listed | |
| MidnightBSD | net/py-h11 | 0.16.0_1 | out of range, by version | |
| FreeBSD | net/py-h11 | 0.16.0 | fixed |