StackRadar

CVE-2025-43859

Critical

Advisory

Published 24 Apr 2025In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
0.006
46th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
133
of 17,781 indexed, latest versions
Container images
139
deployed by those charts
Fix available
1 of 1
affected package

h11 accepts some malformed Chunked-Encoding bodies

Carried by container images the latest versions of 133 of 17,781 indexed charts deploy, on 139 images.

Affected packageAffected versionsFixed inImages
h11pypi0.11.0, 0.12.0, 0.13.0, 0.14.00.16.0139
OSV records
GHSA-vqfr-h8mv-ghfj
Also known as
PYSEC-2026-348

Charts affected

133 by stars
ChartLatestAffected imagesRadar Score
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
h11@0.14.0
0.16.0

Open the chart page →

11,367
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
h11@0.12.0
0.16.0

Open the chart page →

7,705
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
h11@0.14.0
0.16.0

Open the chart page →

5,987
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
h11@0.14.0
0.16.0

Open the chart page →

6,041
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/flaresolverr/flaresolverr:v3.3.21f104ee51e512
h11@0.14.0
0.16.0

Open the chart page →

3,004
syftopenmined0.9.52 of 6See more

syft openmined 0.9.5

2 of the 6 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
h11@0.14.0
0.16.0
openmined/syft-seaweedfs:0.9.53a4144c0bb82
h11@0.14.0
0.16.0

Open the chart page →

17,245
servarrservarr1.0.21 of 10See more

servarr servarr 1.0.2

1 of the 10 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/flaresolverr/flaresolverr:v3.3.16088412db1051
h11@0.14.0
0.16.0

Open the chart page →

14,238
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.11.11da5c38c6a78
h11@0.14.0
0.16.0

Open the chart page →

6,168
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
h11@0.14.0
0.16.0

Open the chart page →

17,404
esphomegeek-cookbookVerified publisher8.4.21 of 1See more

esphome geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
esphome/esphome:1.18.03f51ec10e823
h11@0.12.0
0.16.0

Open the chart page →

3,717
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
h11@0.13.0
0.16.0

Open the chart page →

7,579
clearml-servingallegroaiVerified publisher1.6.21 of 9See more

clearml-serving allegroai 1.6.2

1 of the 9 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
allegroai/clearml-serving-inference:1.3.0fca885e8cfc6
h11@0.14.0
0.16.0

Open the chart page →

17,877
anteonanteonVerified publisher2.6.42 of 13See more

anteon anteon 2.6.4

2 of the 13 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:2.3.11e5be48b37348
h11@0.14.0
0.16.0
ddosify/selfhosted_backend:3.2.93c11e3182652
h11@0.14.0
0.16.0

Open the chart page →

22,202
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
h11@0.14.0
0.16.0

Open the chart page →

11,205
paperless-ngxcrystalnetVerified publisher0.2.221 of 3See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
h11@0.14.0
0.16.0

Open the chart page →

13,761
rommcrystalnetVerified publisher0.2.201 of 3See more

romm crystalnet 0.2.20

1 of the 3 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
zurdi15/romm:2.3.12db88fe44c89
h11@0.14.0
0.16.0

Open the chart page →

1,944
dominodominoVerified publisher0.1.111 of 3See more

domino domino 0.1.11

1 of the 3 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
h11@0.14.0
0.16.0

Open the chart page →

8,823
paperlessgeek-cookbookVerified publisher9.2.01 of 1See more

paperless geek-cookbook 9.2.0

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:1.8.09bbc9a90641e
h11@0.13.0
0.16.0

Open the chart page →

3,924
harp-proxyharp0.8.11 of 1See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
makersquad/harp-proxy:0.8.1a40dd258c527
h11@0.14.0
0.16.0

Open the chart page →

6,374
helmuphelmupVerified publisher0.1.02 of 3See more

helmup helmup 0.1.0

2 of the 3 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
h11@0.14.0
0.16.0
sirrend/helmup-github-scraper:0.1.47ca688c7abf5
h11@0.14.0
0.16.0

Open the chart page →

16,514
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v2.3.1379e31b8c751
h11@0.14.0
0.16.0

Open the chart page →

15,712
difykubeblocksVerified publisher0.5.12 of 5See more

dify kubeblocks 0.5.1

2 of the 5 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
h11@0.14.0
0.16.0
langgenius/dify-sandbox:0.2.009b7e8705673
h11@0.14.0
0.16.0

Open the chart page →

20,403
kuma-ingress-watcherkuma-ingress-watcherVerified publisher1.4.01 of 1See more

kuma-ingress-watcher kuma-ingress-watcher 1.4.0

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/squent/kuma-ingress-watcher:1.7.014d45b2a1f00
h11@0.14.0
0.16.0

Open the chart page →

2,662
clowder2ncsaVerified publisher1.9.73 of 12See more

clowder2 ncsa 1.9.7

3 of the 12 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
h11@0.14.0
0.16.0
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
h11@0.14.0
0.16.0
clowder/clowder2-messages:2.0.0-beta.4bf146f1ca24f
h11@0.14.0
0.16.0

Open the chart page →

37,373
mealiertomik-helm-chartsVerified publisher0.0.21 of 1See more

mealie rtomik-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
h11@0.14.0
0.16.0

Open the chart page →

3,929
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
dserio83/velero-watchdog:0.1.8d5deae589229
h11@0.14.0
0.16.0

Open the chart page →

11,532
slo-reportingslo-reportingVerified publisher0.3.341 of 2See more

slo-reporting slo-reporting 0.3.34

1 of the 2 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/colenio/slo-reporting:0.3.316b64d194a27d
h11@0.14.0
0.16.0

Open the chart page →

2,928
streamlit-appstreamlit-appVerified publisher0.2.01 of 1See more

streamlit-app streamlit-app 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
sruthitanneru/pi-sample:ui-lateste565ea454ffd
h11@0.14.0
0.16.0

Open the chart page →

1,696
esphomealexmorbo-esphomeVerified publisher1.0.01 of 1See more

esphome alexmorbo-esphome 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
esphome/esphome:2024.12.2b2c6322700ac
h11@0.14.0
0.16.0

Open the chart page →

6,324
ddosifyanteonVerified publisher1.7.52 of 13See more

ddosify anteon 1.7.5

2 of the 13 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
h11@0.14.0
0.16.0
ddosify/selfhosted_backend:2.6.11ac323d52bfb4
h11@0.14.0
0.16.0

Open the chart page →

25,669
fllocaloperationsassist-iot-fl-local-operations1.1.01 of 3See more

fllocaloperations assist-iot-fl-local-operations 1.1.0

1 of the 3 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
assistiot/fl_local_operations_inference:latest0518b63a2e69
h11@0.14.0
0.16.0

Open the chart page →

3,786
flrepositorydbassist-iot-fl-repository1.1.01 of 2See more

flrepositorydb assist-iot-fl-repository 1.1.0

1 of the 2 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
assistiot/fl_repository:latest0fce3ea719a5
h11@0.12.0
0.16.0

Open the chart page →

4,367
trainingcollectorassist-iot-fl-training-collector1.1.01 of 1See more

trainingcollector assist-iot-fl-training-collector 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
assistiot/fl_training_collector:latest792715dd3084
h11@0.12.0
0.16.0

Open the chart page →

1,719
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
assistiot/open_api_backend:1.1.230812ba93555
h11@0.14.0
0.16.0

Open the chart page →

18,277
asya-playgroundasya1.1.31 of 1See more

asya-playground asya 1.1.3

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
localstack/localstack:3.19d278167f2b7
h11@0.14.0
0.16.0

Open the chart page →

9,412
azure-app-exporterazure-app-exporterVerified publisher0.4.21 of 2See more

azure-app-exporter azure-app-exporter 0.4.2

1 of the 2 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter:0.1.38b472877847f5
h11@0.14.0
0.16.0

Open the chart page →

1,790
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
h11@0.14.0
0.16.0

Open the chart page →

10,145
colosseumbook-k8sinfra-v21.0.181 of 5See more

colosseum book-k8sinfra-v2 1.0.18

1 of the 5 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-rwd:log74ded2d92f07
h11@0.14.0
0.16.0

Open the chart page →

26,996
opencvecfi20170.1.21 of 7See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
h11@0.14.0
0.16.0

Open the chart page →

15,371
ctk-walkthroughchaostoolkit-walkthrough0.1.03 of 3See more

ctk-walkthrough chaostoolkit-walkthrough 0.1.0

3 of the 3 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
chaostoolkit/back:latest734f3af86125
h11@0.11.0
0.16.0
chaostoolkit/front:latest7f4a7eb9f7df
h11@0.11.0
0.16.0
chaostoolkit/middle:latestb95ba4961cfc
h11@0.11.0
0.16.0

Open the chart page →

5,557
suggestarrcharliecharts0.4.41 of 1See more

suggestarr charliecharts 0.4.4

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ciuse99/suggestarr:v1.0.20d72768245ef5
h11@0.14.0
0.16.0

Open the chart page →

1,126
chat-searchchat-searchVerified publisher0.1.71 of 1See more

chat-search chat-search 0.1.7

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/hemslo/chat-search:latest39d48995a5bd
h11@0.14.0
0.16.0

Open the chart page →

4,042
kube-acp-stackcloudentity2.28.01 of 7See more

kube-acp-stack cloudentity 2.28.0

1 of the 7 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
h11@0.14.0
0.16.0

Open the chart page →

20,900
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
h11@0.14.0
0.16.0

Open the chart page →

6,179
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
h11@0.14.0
0.16.0

Open the chart page →

5,062
datacube-wpsdatacube-charts0.9.01 of 1See more

datacube-wps datacube-charts 0.9.0

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
opendatacube/wps:latest80df355a660b
h11@0.14.0
0.16.0

Open the chart page →

6,172
design-cataloguedesign-catalogue0.1.01 of 2See more

design-catalogue design-catalogue 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
registry.gitlab.com/open-forms/design-catalogue:latestf21f19346b29
h11@0.11.0
0.16.0

Open the chart page →

2,770
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
h11@0.14.0
0.16.0

Open the chart page →

9,607
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
h11@0.14.0
0.16.0

Open the chart page →

9,607
difydify1.0.02 of 4See more

dify dify 1.0.0

2 of the 4 container images this version deploys carry CVE-2025-43859.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
h11@0.14.0
0.16.0
langgenius/dify-sandbox:0.2.009b7e8705673
h11@0.14.0
0.16.0

Open the chart page →

19,224

Container images carrying it

139 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
thelande/kasa_exporter:v0.2.3a1fdb8baa152
h11@0.14.0
0.16.0
1
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
h11@0.14.0
0.16.0
1
wazuh/wazuh-manager:4.11.11da5c38c6a78
h11@0.14.0
0.16.0
1
witcherek7/pav:0.0.342a744f29ac0
h11@0.14.0
0.16.0
1
yetiplatform/yeti:2.9.09bcbe2650a14
h11@0.14.0
0.16.0
1
yetiplatform/yeti:latest9c3006cedcca
h11@0.14.0
0.16.0
1
zurdi15/romm:2.3.12db88fe44c89
h11@0.14.0
0.16.0
1
gcr.io/kubecost1/kubecost-modeling:v0.1.24a2259b098b13
h11@0.14.0
0.16.0
1
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
h11@0.14.0
0.16.0
1
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
h11@0.14.0
0.16.0
1
ghcr.io/colenio/slo-reporting:0.3.316b64d194a27d
h11@0.14.0
0.16.0
1
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
h11@0.14.0
0.16.0
1
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter:0.1.38b472877847f5
h11@0.14.0
0.16.0
1
ghcr.io/flaresolverr/flaresolverr:v3.3.16088412db1051
h11@0.14.0
0.16.0
1
ghcr.io/flaresolverr/flaresolverr:v3.3.21f104ee51e512
h11@0.14.0
0.16.0
1
ghcr.io/hemslo/chat-search:latest39d48995a5bd
h11@0.14.0
0.16.0
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
h11@0.14.0
0.16.0
1
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
h11@0.12.0
0.16.0
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
h11@0.14.0
0.16.0
1
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
h11@0.14.0
0.16.0
1
ghcr.io/immich-app/immich-machine-learning:v2.3.1379e31b8c751
h11@0.14.0
0.16.0
1
ghcr.io/kubiyabot/sdk-py:v1.20.0f108f49570cc
h11@0.14.0
0.16.0
1
ghcr.io/m0nsterrr/hyperglass:v2.0.4f7b5d20c5e42
h11@0.14.0
0.16.0
1
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
h11@0.14.0
0.16.0
1
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
h11@0.14.0
0.16.0
1
ghcr.io/open-telemetry/demo:1.12.0-loadgenerator85c9935ff31b
h11@0.14.0
0.16.0
1
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
h11@0.14.0
0.16.0
1
ghcr.io/paperless-ngx/paperless-ngx:1.8.09bbc9a90641e
h11@0.13.0
0.16.0
1
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
h11@0.14.0
0.16.0
1
ghcr.io/rodg/rtmp-controller:latest67f99a5beab7
h11@0.14.0
0.16.0
1
ghcr.io/squent/kuma-ingress-watcher:1.7.014d45b2a1f00
h11@0.14.0
0.16.0
1
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
h11@0.14.0
0.16.0
1
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
h11@0.14.0
0.16.0
1
public.ecr.aws/k6v9y5g3/cluster-agent:cost_k8s_process.5769e14a72b066d
h11@0.14.0
0.16.0
1
quay.io/mongodb/farm-intro-backend:0.11a9ce0b8fbd4
h11@0.11.0
0.16.0
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
h11@0.14.0
0.16.0
1
registry.gitlab.com/open-forms/design-catalogue:latestf21f19346b29
h11@0.11.0
0.16.0
1
registry.gitlab.com/open-forms/forms-catalogue:latest4eaf9c911f33
h11@0.12.0
0.16.0
1
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
h11@0.12.0
0.16.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.