benoitc/gunicorn vulnerabilities

2 known vulnerabilities in benoitc/gunicorn from Benoitc. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  benoitc/gunicorn: Inconsistent Interpretation of HTTP Requests

  CVE-2024-6827Mar 20, 2025Benoitc

  Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerabilit

• 7.5 High severity

  benoitc/gunicorn: Inconsistent Interpretation of HTTP Requests

  CVE-2024-1135Apr 16, 2024BenoitcEPSS 3%

  Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints.