Bug 2362162 (CVE-2025-43859)

Summary:	CVE-2025-43859 h11: h11 accepts some malformed Chunked-Encoding bodies
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	anpicker, anthomas, aprice, bbrownin, bparees, brking, caswilli, dschmidt, eglynn, ehelms, erezende, ggainey, haoli, hasun, hkataria, jajackso, jcammara, jdobes, jeder, jfula, jjoyce, jkoehler, jmitchel, jneedle, jowilson, jsamir, jschluet, juwatts, jwong, kaycoth, kegrant, kgaikwad, koliveir, kshier, lhh, lphiri, lsvaty, mabashia, mattdavi, mburns, mgarciac, mhulan, nmoumoul, nyancey, oezr, omaciel, ometelka, orabin, osousa, pbraun, pcreech, pgrist, ptisnovs, rchan, shvarugh, simaishi, smallamp, smcdonal, stcannon, syedriko, teagle, tfister, thavo, tmalecek, ttakamiy, xdharmai, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the h11. This vulnerability allows request smuggling via improper parsing of chunked-coding message bodies, where h11 fails to validate the required \r\n terminators.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2362282, 2362283, 2362285, 2362286, 2362287, 2363676
Bug Blocks:

Description OSIDB Bzimport 2025-04-24 19:01:12 UTC

h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in version 0.16.0. Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue.

Comment 2 errata-xmlrpc 2025-05-14 01:02:12 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Services on OpenShift 18.0

Via RHSA-2025:7535 https://access.redhat.com/errata/RHSA-2025:7535

Comment 3 errata-xmlrpc 2025-05-14 01:03:15 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 17.1 for RHEL 9

Via RHSA-2025:7536 https://access.redhat.com/errata/RHSA-2025:7536

Comment 5 errata-xmlrpc 2025-05-27 18:15:31 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.5 for RHEL 8
  Red Hat Ansible Automation Platform 2.5 for RHEL 9

Via RHSA-2025:8221 https://access.redhat.com/errata/RHSA-2025:8221

Comment 7 errata-xmlrpc 2025-06-05 20:51:00 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.4 for RHEL 8
  Red Hat Ansible Automation Platform 2.4 for RHEL 9

Via RHSA-2025:8615 https://access.redhat.com/errata/RHSA-2025:8615