HTTP Request Smuggling in benoitc/gunicorn
Priority MEDIUM 46CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 10 fixed, 5 without a fix
Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks including cache poisoning, session manipulation, and data exposure.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02996 87th percentileScored 2026-11-07
Fix Partial gunicorn (PyPI): 22.0.0Red Hat: 9 advisoriesRed Hat: 10 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| benoitc | benoitc/gunicorn | up to latest | — | No fix listed | CNA |
| — | gunicorn (PyPI) | before 22.0.0 | 22.0.0 | Patch available | GHSA-w3h3-4rj7-4ph4 |
- benoitc/gunicorn Vendorbenoitc Affected up to latest Fixed in — No fix listed CNA
- gunicorn (PyPI) Vendor— Affected before 22.0.0 Fixed in 22.0.0 Patch available GHSA-w3h3-4rj7-4ph4
Remediation
- Fix · GHSA-w3h3-4rj7-4ph4 gunicorn (PyPI) Fixed in 22.0.0 Advisory →
Red Hat 9 advisories
- RHSA-2025:1335 Released 2025-02-12 · Red Hat rating ImportantRHUI 4.11 security, bugfix, and enhancement update
- RHUI 4 for RHEL 8 python-aiohttp-3.9.4-1.el8ui, python-cryptography-42.0.8-1.el8ui, python-django-4.2.15-1.el8ui +13
- RHSA-2024:7987 Released 2024-10-10 · Red Hat rating ModerateSatellite 6.15.4 Security Update
- Red Hat Satellite 6.15 for RHEL 8 python-cryptography-42.0.8-1.el8pc, python-django-4.2.15-1.el8pc, python-gunicorn-22.0.0-1.el8pc +5
- RHSA-2024:4054 Released 2024-06-24 · Red Hat rating ImportantRed Hat OpenStack Platform 16.2 (python-gunicorn) security update
- Red Hat OpenStack Platform 16.2 python-gunicorn-19.9.0-11.el8ost, python3-gunicorn-19.9.0-11.el8ost
Show 6 more Red Hat advisories
- RHSA-2024:3713 Released 2024-06-12 · Red Hat rating ImportantOpenShift Container Platform 4.12.59 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 openshift4/ose-ironic-rhel9
- RHSA-2024:3781 Released 2024-06-10 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower-4.5.7-1.el8ap, automation-hub-4.9.2-1.el8ap, python39-aiohttp-3.9.5-1.el8ap +25
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower-4.5.7-1.el9ap, automation-hub-4.9.2-1.el9ap, python-aiohttp-3.9.5-1.el9ap +25
- RHSA-2024:3331 Released 2024-05-30 · Red Hat rating ImportantOpenShift Container Platform 4.14.27 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-cluster-autoscaler-operator, openshift4/ose-ironic-rhel9, openshift4/ose-machine-api-operator
- RHSA-2024:3327 Released 2024-05-29 · Red Hat rating ImportantOpenShift Container Platform 4.15.15 security update
- Red Hat OpenShift Container Platform 4.15 openshift4/ose-ironic-rhel9, openshift4/ose-powervs-block-csi-driver-rhel9, openshift4/ose-telemeter-rhel9
- RHSA-2024:2875 Released 2024-05-23 · Red Hat rating ImportantOpenShift Container Platform 4.13.42 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 openshift4/ose-aws-pod-identity-webhook-rhel8, openshift4/ose-cloud-credential-operator, openshift4/ose-cluster-etcd-rhel8-operator +3
- RHSA-2024:2727 Released 2024-05-22 · Red Hat rating ImportantRed Hat OpenStack Platform 17.1 (python-gunicorn) security update
- Red Hat OpenStack Platform 17.1 python-gunicorn-20.0.4-7.el9ost, python3-gunicorn-20.0.4-7.el9ost
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.1 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix planned: Out of support scope |
| RHUI 4 for RHEL 8 | Fixed | RHSA-2025:1335 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Fixed | RHSA-2024:3781 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Fixed | RHSA-2024:3781 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2024:3713 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2024:2875 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2024:3331 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2024:3327 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2024:4054 |
| Red Hat OpenStack Platform 17.1 | Fixed | RHSA-2024:2727 |
| Red Hat Satellite 6.15 for RHEL 8 | Fixed | RHSA-2024:7987 |
Not affected: 9 products
- RHUI 4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Red Hat Discovery 1
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat Satellite 6.15 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2024-1135
- 2026-10-03 Alias added: GHSA-w3h3-4rj7-4ph4
References
Other 8
- https://huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1
- https://lists.debian.org/debian-lts-announce/2024/06/msg00027.html
- https://github.com/benoitc/gunicorn/issues/3091
- https://github.com/benoitc/gunicorn/pull/3113
- https://github.com/benoitc/gunicorn/commit/ac29c9b0a758d21f1e0fb3b3457239e523fa9f1d
- https://github.com/benoitc/gunicorn
- https://github.com/benoitc/gunicorn/releases/tag/22.0.0
- https://lists.debian.org/debian-lts-announce/2024/12/msg00018.html
More benoitc vulnerabilities
- TI-2026-34675 Unbounded memory consumption in WebSocket client in hackney CVSS 4.0HIGH 8.7
- TI-2026-34669 Atom table exhaustion via unrecognized URL schemes in hackney CVSS 4.0HIGH 8.7
- TI-2026-34668 Infinite loop in Alt-Svc header parser in hackney CVSS 4.0HIGH 8.7
- TI-2026-34679 Unbounded body accumulation in HTTP/3 response loop in hackney CVSS 4.0HIGH 8.2
- TI-2026-34673 SOCKS5 TLS upgrade ignores caller timeout in hackney CVSS 4.0HIGH 8.2
- TI-2024-06330 HTTP Request Smuggling in benoitc/gunicorn CVSS 3.0HIGH 7.5
Sources
- CVE-2024-1135 · CVE Program
- CVE-2024-1135 · NVD
- FIRST EPSS
- GHSA-w3h3-4rj7-4ph4 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-1135 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences