Skip to content
OpenAdvisories

Package · Debian

gunicorn

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.5
    CVE-2024-6827

    HTTP Request Smuggling in benoitc/gunicorn

    Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerabili…

    benoitc benoitc/gunicorn emissary emissary-apiext Debian Ubuntu Wolfi PyPI
  • High 7.5
    CVE-2024-1135

    HTTP Request Smuggling in benoitc/gunicorn

    Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints…

    benoitc benoitc/gunicorn reflex gunicorn Debian Ubuntu Wolfi PyPI
  • High 7.5
    CVE-2018-1000164

    Gunicorn contains Improper Neutralization of CRLF sequences in HTTP headers

    gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. Th…

    gunicorn gunicorn gunicorn Debian Ubuntu PyPI