h11 versions prior to 0.16.0 improperly parse the trailing bytes in HTTP/1.1 chunked transfer encoding bodies, accepting malformed chunk terminators. This leniency can cause discrepancies in how h11 and certain buggy proxies interpret HTTP requests, enabling HTTP request smuggling attacks. An attacker could exploit this to bypass security controls or steal session credentials. The issue is fixed in h11 version 0.16.0.