Skip to content
OpenAdvisories
High DLA-3996-1 1 CVE

gunicorn - security update

Published Dec 20, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 gunicorn 20.1.0-1+deb11u1

Vulnerabilities 1

  • High 7.5
    CVE-2024-1135

    HTTP Request Smuggling in benoitc/gunicorn

    Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints…

    benoitc benoitc/gunicorn reflex gunicorn Debian Ubuntu Wolfi PyPI