USN-7503-1: h11 vulnerability

USN-7503-1: h11 vulnerability
8 May 2025

• python-h11 could be made to expose sensitive information over the network.

Releases

• Ubuntu 25.04
• Ubuntu 24.10
• Ubuntu 24.04 LTS

Packages
python-h11 - Pure-Python, bring-your-own-I/O implementation of HTTP/1.1

Details
Jeppe Bonde Weikop discovered that h11 incorrectly handled crafted HTTP
requests. A remote attacker could possibly use this issue to smuggle
malicious HTTP requests, which could potentially lead to security
control bypass and information leakage.

Update instructions
The problem can be corrected by updating your system to the following package versions:

Ubuntu 25.04

• python3-h11 - 0.14.0-1ubuntu0.25.04.1
  Ubuntu 24.10
• python3-h11 - 0.14.0-1ubuntu0.24.10.1
  Ubuntu 24.04
• python3-h11 - 0.14.0-1ubuntu0.24.04.1
  In general, a standard system update will make all the necessary changes.