Threats affecting pkg:brew/certbot

CVE-2025-43859 is a critical vulnerability in h11's handling of HTTP/1.1 chunked transfer encoding. h11 versions up to 0.14.0 incorrectly accept malformed chunked bodies by not validating the trailing CRLF bytes after each chunk. This leniency can cause request smuggling when combined with a proxy that parses chunked bodies differently, potentially allowing attackers to bypass security controls or steal session credentials. The issue is fixed in h11 version 0.15.0. Exploitation requires both a buggy h11 and a buggy proxy, so fixing either component mitigates the risk.