CVE-2026-103995: Lenient parsing of integers for response body and chunk framing
Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.
Affected Software
Event History
Frequently Asked Questions
What access or interaction is required for exploitation?
The vector indicates network reachability, low attack complexity, high privileges required, and user interaction required. The supplied data does not specify what form those privileges or interaction take.
What is the practical security impact?
The stated impact is incorrect interpretation of HTTP response contents due to lenient parsing of response-body and chunk-framing integers. The CVSS vector records no confidentiality, integrity, or availability impact on the vulnerable component, but a low integrity impact on a subsequent system.
How can I determine whether my deployment is affected?
Review whether your environment uses the PyPI package h11 and processes HTTP responses with response bodies or chunked framing. The provided data does not identify affected or fixed versions, so version-based determination is not possible from this information.