p PatchFirst

CVE-2024-6827

CVE-2024-6827 · HTTP Request Smuggling in benoitc/gunicorn

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.

CVSS 7.5 · High · EPSS 0.8% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • benoitc/gunicorn

    Versions
    • ≥ unspecified, ≤ latest: Affected (custom)

    No fix published

  • gunicorn Debian:12

    Versions
    • 20.1.0-6
    • 20.1.0-6+deb12u1
    • 22.0.0-1
    • 23.0.0-1
    • 25.0.3-1
    • 25.0.3-2
    • 25.1.0-1
    • 25.3.0-1
    • 25.3.0-2
    • 25.3.0-3
    • 25.3.0-4
    • 26.2.2-1
    • 26.2.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gunicorn Debian:13

    Affected ranges
    • ECOSYSTEM: < 23.0.0-1

    Update to 23.0.0-1

  • gunicorn Debian:14

    Affected ranges
    • ECOSYSTEM: < 23.0.0-1

    Update to 23.0.0-1

  • gunicorn PyPI

    Versions
    • 0.1
    • 0.10.0
    • 0.10.1
    • 0.11.0
    • 0.11.1
    • 0.11.2
    • 0.12.0
    • 0.12.1
    • 0.12.2
    • 0.13.0
    • 0.13.1
    • 0.13.2
    • 0.13.3
    • 0.13.4
    • 0.14.0
    • 0.14.1
    • 0.14.2
    • 0.14.3
    • 0.14.4
    • 0.14.5
    • 0.14.6
    • 0.15.0
    • 0.16.0
    • 0.16.1
    • 0.17.0
    • 0.17.1
    • 0.17.2
    • 0.17.3
    • 0.17.4
    • 0.2
    • 0.2.1
    • 0.3
    • 0.3.1
    • 0.3.2
    • 0.4
    • 0.4.1
    • 0.4.2
    • 0.5
    • 0.5.1
    • 0.6
    • 0.6.1
    • 0.6.2
    • 0.6.3
    • 0.6.4
    • 0.6.5
    • 0.6.6
    • 0.7.0
    • 0.7.1
    • 0.7.2
    • 0.8.0
    • 0.8.1
    • 0.9.0
    • 0.9.1
    • 17.5
    • 18.0
    • 19.0.0
    • 19.1.0
    • 19.1.1
    • 19.10.0
    • 19.2.0
    • 19.2.1
    • 19.3.0
    • 19.4.0
    • 19.4.1
    • 19.4.2
    • 19.4.3
    • 19.4.4
    • 19.4.5
    • 19.5.0
    • 19.6.0
    • 19.7.0
    • 19.7.1
    • 19.8.0
    • 19.8.1
    • 19.9.0
    • 20.0.0
    • 20.0.1
    • 20.0.2
    • 20.0.3
    • 20.0.4
    • 20.1.0
    • 21.0.0
    • 21.0.1
    • 21.1.0
    • 21.2.0
    Affected ranges
    • ECOSYSTEM: < 22.0.0

    Update to 22.0.0

  • gunicorn Ubuntu:Pro:14.04:LTS

    Versions
    • 17.5-2
    • 17.5-2build1
    • 17.5-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gunicorn Ubuntu:16.04:LTS

    Versions
    • 19.0-8ubuntu1
    • 19.4.1-1ubuntu1
    • 19.4.5-1ubuntu1
    • 19.4.5-1ubuntu1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gunicorn Ubuntu:18.04:LTS

    Versions
    • 19.7.1-3
    • 19.7.1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gunicorn Ubuntu:20.04:LTS

    Versions
    • 19.9.0-1
    • 19.9.0-4
    • 20.0.0-1
    • 20.0.2-1
    • 20.0.4-1
    • 20.0.4-2
    • 20.0.4-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gunicorn Ubuntu:22.04:LTS

    Versions
    • 20.1.0-1
    • 20.1.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gunicorn Ubuntu:24.04:LTS

    Versions
    • 20.1.0-6
    • 20.1.0-6ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gunicorn Ubuntu:25.10

    Versions
    • 23.0.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gunicorn Ubuntu:26.10

    Versions
    • 25.1.0-1
    • 25.3.0-2
    • 25.3.0-3
    • 25.3.0-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gunicorn Ubuntu:26.04:LTS

    Versions
    • 23.0.0-1
    • 23.0.0-1build1
    • 25.0.3-2
    • 25.1.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →