CVE-2024-6827: Gunicorn HTTP Request/Response Smuggling Vulnerability
Summary
CVE-2024-6827: Gunicorn HTTP Request/Response Smuggling vulnerability. Affects gunicorn versions < 22.0.0. Fixed in 22.0.0. How to fix ↓
Also tracked for
- gunicorn · Debian:11
The same CVE-2024-6827 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gunicorn is a Python WSGI HTTP server for UNIX that serves web applications in a concurrent manner. It is widely used for deploying Python web applications due to its simplicity and performance. Gunicorn supports various worker types and is designed to handle multiple requests simultaneously. However, a vulnerability in version 21.2.0 allows improper validation of the 'Transfer-Encoding' header, exposing it to serious security risks.
Vulnerability Detail
The vulnerability in Gunicorn arises from its failure to properly validate the 'Transfer-Encoding' header as per RFC standards. This oversight allows attackers to exploit the default fallback method of 'Content-Length', leading to TE.CL (Transfer-Encoding: Chunked) request smuggling. The implications of this vulnerability are severe, including cache poisoning, data exposure, session manipulation, server-side request forgery (SSRF), cross-site scripting (XSS), denial of service (DoS), data integrity compromise, security bypass, information leakage, and business logic abuse.
How To Fix
Latest published version: 26.2.0 as of 22 Oct 2026
pip install --upgrade "gunicorn==26.2.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
22.0.0
This is the first release that contains the fix.
pip install --upgrade "gunicorn==22.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can configure your application to avoid using the 'Transfer-Encoding' header or implement additional validation checks on incoming requests to mitigate the risk of exploitation until the package is updated.
Conclusion
The Gunicorn HTTP Request/Response Smuggling vulnerability (CVE-2024-6827) poses significant risks to applications using version 21.2.0. It is crucial to update to version 22.0.0 or later to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in your dependencies effectively.
See every vulnerability recorded for gunicorn →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Gunicorn version 21.2.0 is affected by this vulnerability. Versions prior to 22.0.0 are also vulnerable.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.
Yes, Vulert can monitor and alert in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
References
Related vulnerabilities
Recent vulnerabilities recorded for gunicorn.
