StackRadar

CVE-2025-43859

Critical

Advisory

Published 24 Apr 2025In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
0.006
46th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
133
of 17,781 indexed, latest versions
Container images
139
deployed by those charts
Fix available
1 of 1
affected package

h11 accepts some malformed Chunked-Encoding bodies

Carried by container images the latest versions of 133 of 17,781 indexed charts deploy, on 139 images.

Affected packageAffected versionsFixed inImages
h11pypi0.11.0, 0.12.0, 0.13.0, 0.14.00.16.0139
OSV records
GHSA-vqfr-h8mv-ghfj
Also known as
PYSEC-2026-348

Charts affected

133 by stars
ChartLatestAffected imagesRadar Score
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
h11@0.14.0
0.16.0

Open the chart page →

11,367
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
h11@0.12.0
0.16.0

Open the chart page →

7,705
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
h11@0.14.0
0.16.0

Open the chart page →

5,987
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
h11@0.14.0
0.16.0

Open the chart page →

6,041
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/flaresolverr/flaresolverr:v3.3.21f104ee51e512
h11@0.14.0
0.16.0

Open the chart page →

3,004
syftopenmined0.9.52 of 6See more

syft openmined 0.9.5

2 of the 6 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
h11@0.14.0
0.16.0
openmined/syft-seaweedfs:0.9.53a4144c0bb82
h11@0.14.0
0.16.0

Open the chart page →

17,245
servarrservarr1.0.21 of 10See more

servarr servarr 1.0.2

1 of the 10 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/flaresolverr/flaresolverr:v3.3.16088412db1051
h11@0.14.0
0.16.0

Open the chart page →

14,238
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.11.11da5c38c6a78
h11@0.14.0
0.16.0

Open the chart page →

6,168
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
h11@0.14.0
0.16.0

Open the chart page →

17,404
esphomegeek-cookbookVerified publisher8.4.21 of 1See more

esphome geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
esphome/esphome:1.18.03f51ec10e823
h11@0.12.0
0.16.0

Open the chart page →

3,717
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
h11@0.13.0
0.16.0

Open the chart page →

7,579
clearml-servingallegroaiVerified publisher1.6.21 of 9See more

clearml-serving allegroai 1.6.2

1 of the 9 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
allegroai/clearml-serving-inference:1.3.0fca885e8cfc6
h11@0.14.0
0.16.0

Open the chart page →

17,877
anteonanteonVerified publisher2.6.42 of 13See more

anteon anteon 2.6.4

2 of the 13 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:2.3.11e5be48b37348
h11@0.14.0
0.16.0
ddosify/selfhosted_backend:3.2.93c11e3182652
h11@0.14.0
0.16.0

Open the chart page →

22,202
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
h11@0.14.0
0.16.0

Open the chart page →

11,205
paperless-ngxcrystalnetVerified publisher0.2.221 of 3See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
h11@0.14.0
0.16.0

Open the chart page →

13,761
rommcrystalnetVerified publisher0.2.201 of 3See more

romm crystalnet 0.2.20

1 of the 3 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
zurdi15/romm:2.3.12db88fe44c89
h11@0.14.0
0.16.0

Open the chart page →

1,944
dominodominoVerified publisher0.1.111 of 3See more

domino domino 0.1.11

1 of the 3 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
h11@0.14.0
0.16.0

Open the chart page →

8,823
paperlessgeek-cookbookVerified publisher9.2.01 of 1See more

paperless geek-cookbook 9.2.0

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:1.8.09bbc9a90641e
h11@0.13.0
0.16.0

Open the chart page →

3,924
harp-proxyharp0.8.11 of 1See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
makersquad/harp-proxy:0.8.1a40dd258c527
h11@0.14.0
0.16.0

Open the chart page →

6,374
helmuphelmupVerified publisher0.1.02 of 3See more

helmup helmup 0.1.0

2 of the 3 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
h11@0.14.0
0.16.0
sirrend/helmup-github-scraper:0.1.47ca688c7abf5
h11@0.14.0
0.16.0

Open the chart page →

16,514
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v2.3.1379e31b8c751
h11@0.14.0
0.16.0

Open the chart page →

15,712
difykubeblocksVerified publisher0.5.12 of 5See more

dify kubeblocks 0.5.1

2 of the 5 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
h11@0.14.0
0.16.0
langgenius/dify-sandbox:0.2.009b7e8705673
h11@0.14.0
0.16.0

Open the chart page →

20,403
kuma-ingress-watcherkuma-ingress-watcherVerified publisher1.4.01 of 1See more

kuma-ingress-watcher kuma-ingress-watcher 1.4.0

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/squent/kuma-ingress-watcher:1.7.014d45b2a1f00
h11@0.14.0
0.16.0

Open the chart page →

2,662
clowder2ncsaVerified publisher1.9.73 of 12See more

clowder2 ncsa 1.9.7

3 of the 12 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
h11@0.14.0
0.16.0
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
h11@0.14.0
0.16.0
clowder/clowder2-messages:2.0.0-beta.4bf146f1ca24f
h11@0.14.0
0.16.0

Open the chart page →

37,373
mealiertomik-helm-chartsVerified publisher0.0.21 of 1See more

mealie rtomik-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
h11@0.14.0
0.16.0

Open the chart page →

3,929
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
dserio83/velero-watchdog:0.1.8d5deae589229
h11@0.14.0
0.16.0

Open the chart page →

11,532
slo-reportingslo-reportingVerified publisher0.3.341 of 2See more

slo-reporting slo-reporting 0.3.34

1 of the 2 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/colenio/slo-reporting:0.3.316b64d194a27d
h11@0.14.0
0.16.0

Open the chart page →

2,928
streamlit-appstreamlit-appVerified publisher0.2.01 of 1See more

streamlit-app streamlit-app 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
sruthitanneru/pi-sample:ui-lateste565ea454ffd
h11@0.14.0
0.16.0

Open the chart page →

1,696
esphomealexmorbo-esphomeVerified publisher1.0.01 of 1See more

esphome alexmorbo-esphome 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
esphome/esphome:2024.12.2b2c6322700ac
h11@0.14.0
0.16.0

Open the chart page →

6,324
ddosifyanteonVerified publisher1.7.52 of 13See more

ddosify anteon 1.7.5

2 of the 13 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
h11@0.14.0
0.16.0
ddosify/selfhosted_backend:2.6.11ac323d52bfb4
h11@0.14.0
0.16.0

Open the chart page →

25,669
fllocaloperationsassist-iot-fl-local-operations1.1.01 of 3See more

fllocaloperations assist-iot-fl-local-operations 1.1.0

1 of the 3 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
assistiot/fl_local_operations_inference:latest0518b63a2e69
h11@0.14.0
0.16.0

Open the chart page →

3,786
flrepositorydbassist-iot-fl-repository1.1.01 of 2See more

flrepositorydb assist-iot-fl-repository 1.1.0

1 of the 2 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
assistiot/fl_repository:latest0fce3ea719a5
h11@0.12.0
0.16.0

Open the chart page →

4,367
trainingcollectorassist-iot-fl-training-collector1.1.01 of 1See more

trainingcollector assist-iot-fl-training-collector 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
assistiot/fl_training_collector:latest792715dd3084
h11@0.12.0
0.16.0

Open the chart page →

1,719
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
assistiot/open_api_backend:1.1.230812ba93555
h11@0.14.0
0.16.0

Open the chart page →

18,277
asya-playgroundasya1.1.31 of 1See more

asya-playground asya 1.1.3

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
localstack/localstack:3.19d278167f2b7
h11@0.14.0
0.16.0

Open the chart page →

9,412
azure-app-exporterazure-app-exporterVerified publisher0.4.21 of 2See more

azure-app-exporter azure-app-exporter 0.4.2

1 of the 2 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter:0.1.38b472877847f5
h11@0.14.0
0.16.0

Open the chart page →

1,790
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
h11@0.14.0
0.16.0

Open the chart page →

10,145
colosseumbook-k8sinfra-v21.0.181 of 5See more

colosseum book-k8sinfra-v2 1.0.18

1 of the 5 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-rwd:log74ded2d92f07
h11@0.14.0
0.16.0

Open the chart page →

26,996
opencvecfi20170.1.21 of 7See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
h11@0.14.0
0.16.0

Open the chart page →

15,371
ctk-walkthroughchaostoolkit-walkthrough0.1.03 of 3See more

ctk-walkthrough chaostoolkit-walkthrough 0.1.0

3 of the 3 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
chaostoolkit/back:latest734f3af86125
h11@0.11.0
0.16.0
chaostoolkit/front:latest7f4a7eb9f7df
h11@0.11.0
0.16.0
chaostoolkit/middle:latestb95ba4961cfc
h11@0.11.0
0.16.0

Open the chart page →

5,557
suggestarrcharliecharts0.4.41 of 1See more

suggestarr charliecharts 0.4.4

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ciuse99/suggestarr:v1.0.20d72768245ef5
h11@0.14.0
0.16.0

Open the chart page →

1,126
chat-searchchat-searchVerified publisher0.1.71 of 1See more

chat-search chat-search 0.1.7

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/hemslo/chat-search:latest39d48995a5bd
h11@0.14.0
0.16.0

Open the chart page →

4,042
kube-acp-stackcloudentity2.28.01 of 7See more

kube-acp-stack cloudentity 2.28.0

1 of the 7 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
h11@0.14.0
0.16.0

Open the chart page →

20,900
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
h11@0.14.0
0.16.0

Open the chart page →

6,179
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
h11@0.14.0
0.16.0

Open the chart page →

5,062
datacube-wpsdatacube-charts0.9.01 of 1See more

datacube-wps datacube-charts 0.9.0

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
opendatacube/wps:latest80df355a660b
h11@0.14.0
0.16.0

Open the chart page →

6,172
design-cataloguedesign-catalogue0.1.01 of 2See more

design-catalogue design-catalogue 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
registry.gitlab.com/open-forms/design-catalogue:latestf21f19346b29
h11@0.11.0
0.16.0

Open the chart page →

2,770
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
h11@0.14.0
0.16.0

Open the chart page →

9,607
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
h11@0.14.0
0.16.0

Open the chart page →

9,607
difydify1.0.02 of 4See more

dify dify 1.0.0

2 of the 4 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
h11@0.14.0
0.16.0
langgenius/dify-sandbox:0.2.009b7e8705673
h11@0.14.0
0.16.0

Open the chart page →

19,224

Container images carrying it

139 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
opea/llm-tgi:1.00c25aab3f106
h11@0.14.0
0.16.0
4
shashkist/flask-contacts-app:latest581de1fd6084
h11@0.14.0
0.16.0
4
quay.io/devtron/ai-agent:0.0.16545dac92173
h11@0.14.0
0.16.0
3
langgenius/dify-sandbox:0.2.009b7e8705673
h11@0.14.0
0.16.0
2
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
h11@0.12.0
0.16.0
2
opea/embedding-tei:1.05c9639de61c1
h11@0.14.0
0.16.0
2
opea/reranking-tei:1.0e48613afb191
h11@0.14.0
0.16.0
2
opea/retriever-redis:1.0eb746b263705
h11@0.14.0
0.16.0
2
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
h11@0.14.0
0.16.0
2
allegroai/clearml-serving-inference:1.3.0fca885e8cfc6
h11@0.14.0
0.16.0
1
apache/airflow:2.8.4-python3.964e58748b6b9
h11@0.14.0
0.16.0
1
apache/airflow:2.10.2-python3.9ce90bdc3d2af
h11@0.14.0
0.16.0
1
apache/airflow:2.8.1e5560ad0b86e
h11@0.14.0
0.16.0
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
h11@0.14.0
0.16.0
1
archish27/python-fastapi-postgres:latest6610071a2101
h11@0.13.0
0.16.0
1
asdkant/fastapi-hello-world:latesta23d8bf7c885
h11@0.11.0
0.16.0
1
assistiot/fl_local_operations_inference:latest0518b63a2e69
h11@0.14.0
0.16.0
1
assistiot/fl_repository:latest0fce3ea719a5
h11@0.12.0
0.16.0
1
assistiot/fl_training_collector:latest792715dd3084
h11@0.12.0
0.16.0
1
assistiot/open_api_backend:1.1.230812ba93555
h11@0.14.0
0.16.0
1
baserow/backend:1.31.1e0b3c8130b91
h11@0.14.0
0.16.0
1
baserow/baserow:1.30.1df0c42eb67e8
h11@0.14.0
0.16.0
1
bmeares/meerschaum:2.8.48e9c5bacaa82
h11@0.14.0
0.16.0
1
bnjbvr/kresus:0.22.137e216b182c8
h11@0.14.0
0.16.0
1
cadmusthefounder/lnd:take-the-helm-0.1.0e596c5fbf80f
h11@0.13.0
0.16.0
1
cdignam/kodiak:v0.54.05a6a55b39cee
h11@0.12.0
0.16.0
1
chaostoolkit/back:latest734f3af86125
h11@0.11.0
0.16.0
1
chaostoolkit/front:latest7f4a7eb9f7df
h11@0.11.0
0.16.0
1
chaostoolkit/middle:latestb95ba4961cfc
h11@0.11.0
0.16.0
1
ciuse99/suggestarr:v1.0.20d72768245ef5
h11@0.14.0
0.16.0
1
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
h11@0.14.0
0.16.0
1
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
h11@0.14.0
0.16.0
1
clowder/clowder2-messages:2.0.0-beta.4bf146f1ca24f
h11@0.14.0
0.16.0
1
clsen2024/gwangju_2-3:service-b-10ba9eff852c5
h11@0.14.0
0.16.0
1
clsen2024/gwangju_2-3:service-a-151b1d45961cd
h11@0.14.0
0.16.0
1
clsen2024/gwangju_2-3:service-c-1efb1586c8299
h11@0.14.0
0.16.0
1
codecov/self-hosted-api:24.4.10475cb1c3136
h11@0.12.0
0.16.0
1
codecov/self-hosted-worker:24.4.1837f546b479b
h11@0.14.0
0.16.0
1
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
h11@0.14.0
0.16.0
1
ddosify/selfhosted_alaz_backend:2.3.11e5be48b37348
h11@0.14.0
0.16.0
1
ddosify/selfhosted_backend:3.2.93c11e3182652
h11@0.14.0
0.16.0
1
ddosify/selfhosted_backend:2.6.11ac323d52bfb4
h11@0.14.0
0.16.0
1
douz/helpdesk:latest4384103d0219
h11@0.12.0
0.16.0
1
dpage/pgadmin4:8.418cd5711fc9a
h11@0.14.0
0.16.0
1
dpage/pgadmin4:9.252cb72a9e3da
h11@0.14.0
0.16.0
1
dpage/pgadmin4:8.13561c1f8f99f2
h11@0.14.0
0.16.0
1
dserio83/velero-watchdog:0.1.8d5deae589229
h11@0.14.0
0.16.0
1
eclipseaerios/aerios-k8s-shim:v1.0.0d4ed3d8e5db4
h11@0.14.0
0.16.0
1
eclipseaerios/hlo-data-aggregator:v3.0.0b433c2b9f5dc
h11@0.14.0
0.16.0
1
eclipseaerios/hlo-deployment-engine:v3.0.0d582d39208c7
h11@0.14.0
0.16.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.