CVE-2024-1135 json
HTTP Request Smuggling in benoitc/gunicorn
published 2024-04-16 2 y ago modified 2026-09-10 1 mo ago also GHSA-w3h3-4rj7-4ph4 , PYSEC-2026-1434 , EUVD-2024-1316
- cvss
- 7.5
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.0%
- EPSS 3.0% chance of exploitation in 30 days, percentile 87%
- public exploits
- 0
- none known
Summary
Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks including cache poisoning, session manipulation, and data exposure.
Patch / fix
- pypi gunicorn 22.0.0
- gunicorn Debian 12 20.1.0-6+deb12u1
- gunicorn Debian 14, Debian 13 22.0.0-1
debian advisories DEBIAN-CVE-2024-1135
- python-django rhui 4 4.2.15-1.el8ui
- python-grpcio rhui 4 1.65.4-1.el8ui
- python-jinja2 rhui 4 3.1.4-1.el8ui
- python-aiohttp rhui 4 3.9.4-1.el8ui
- python-gunicorn rhui 4 22.0.0-1.0.1.el8ui
- python-requests rhui 4 2.32.3-2.el8ui
- python-sqlparse rhui 4 0.5.0-1.el8ui
- python3.11-django rhui 4 4.2.15-1.el8ui
red hat advisories RHSA-2025:1335RHSA-2024:7987RHSA-2024:3781RHSA-2024:4054RHSA-2024:2727
- python-gunicorn SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 +3 more 19.7.1-150000.3.7.1
- python-gunicorn SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Module for Python 3 15 SP5 +3 more 20.1.0-150400.12.6.1
suse advisories SUSE-SU-2024:2881-1SUSE-SU-2024:1440-1
- github.com/benoitc/gunicorn@ac29c9b commit
- github.com/benoitc/gunicorn#3113 pull request
- github.com/benoitc/gunicorn/releases/tag/22.0.0 release
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-1135 updated cvss 7.5
python-gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding headers
-
Red Hat Enterprise Linux 7 python-gunicorn Red Hat OpenStack Platform 16.1 python3-gunicornaffected: workaround, no fix planned “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
-
Red Hat OpenStack Platform 18.0 python-gunicorn Red Hat Quay 3 quay/quay-rhel8affected: workaround, no fix available “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
-
Red Hat Storage 3 graphite-webaffected: workaround, no fix planned “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
-
Red Hat Ansible Automation Platform 2.4 for RHEL 8 python39-gunicorn 22.0.0-1.el8ap, python3x-gunicorn 22.0.0-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-gunicorn 22.0.0-1.el9ap, python3-gunicorn 22.0.0-1.el9apfixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:3781
-
Red Hat OpenShift Container Platform 4.12 openshift4/ose-ironic-rhel9 v4.12.0-202406060836.p0.g9a3e609.assembly.stream.el9fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:3713
-
Red Hat OpenShift Container Platform 4.13 openshift4/ose-ironic-rhel9 v4.13.0-202405072309.p0.g881e793.assembly.stream.el9fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:2875
-
Red Hat OpenShift Container Platform 4.14 openshift4/ose-ironic-rhel9 v4.14.0-202405161337.p0.g62ee6d0.assembly.stream.el9fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:3331
-
Red Hat OpenShift Container Platform 4.15 openshift4/ose-ironic-rhel9 v4.15.0-202405161507.p0.ge2415c8.assembly.stream.el9fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:3327
show 5 moreshow fewer
-
Red Hat OpenStack Platform 16.2 python-gunicorn 19.9.0-11.el8ost, python3-gunicorn 19.9.0-11.el8ostfixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:4054
-
Red Hat OpenStack Platform 17.1 python-gunicorn 20.0.4-7.el9ost, python3-gunicorn 20.0.4-7.el9ostfixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:2727
-
Red Hat Satellite 6.15 for RHEL 8 python-gunicorn 22.0.0-1.el8pc, python3.11-gunicorn 22.0.0-1.el8pcfixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:7987
-
Red Hat RHUI 4 for RHEL 8 python-gunicorn 22.0.0-1.0.1.el8ui, python3.11-gunicorn 22.0.0-1.0.1.el8uifixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2025:1335
-
Red Hat Ansible Automation Platform 2.4 for RHEL 8 receptor 1.4.8-1.el8ap, python39-idna 3.7-1.el8ap, python3x-idna 3.7-1.el8ap, receptorctl 1.4.8-1.el8ap, ansible-core 2.15.11-1.el8ap, ansible-test 2.15.11-1.el8ap, +37 more Red Hat Ansible Automation Platform 2.4 for RHEL 9 receptor 1.4.8-1.el9ap, python-idna 3.7-1.el9ap, python3-idna 3.7-1.el9ap, receptorctl 1.4.8-1.el9ap, python-black 22.8.0-2.el9ap, python-jinja2 3.1.4-1.el9ap, +37 more Red Hat Discovery 1 discovery-server-container Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202406041519-0, openshift4/ose-cli v4.12.0-202405222205.p0.gd691257.assembly.stream.el8, openshift4/ose-pod v4.12.0-202406041136.p0.g306a47e.assembly.stream.el8, openshift4/ose-etcd v4.12.0-202405222205.p0.gbb82e89.assembly.stream.el8, openshift4/ose-tests v4.12.0-202406041306.p0.g7b7d4ef.assembly.stream.el8, openshift4/ose-console v4.12.0-202405290906.p0.g6f246c0.assembly.stream.el8, +185 more Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202405132113-0, openshift4/ose-cli v4.13.0-202405141537.p0.gd192e90.assembly.stream.el8, openshift4/ose-pod v4.13.0-202405141537.p0.g4818370.assembly.stream.el8, openshift4/ose-tests v4.13.0-202405141537.p0.g99b9d53.assembly.stream.el8, openshift4/ose-console v4.13.0-202405141537.p0.ga1d0be0.assembly.stream.el8, openshift4/ose-coredns v4.13.0-202405141537.p0.g298d919.assembly.stream.el8, +186 more Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202405162017-0, openshift4/ose-pod v4.14.0-202405161938.p0.g048520e.assembly.stream.el8, openshift4/ose-console v4.14.0-202405201438.p0.gb9c2c6f.assembly.stream.el8, openshift4/ose-installer v4.14.0-202405170238.p0.g3343d79.assembly.stream.el8, openshift4/ose-etcd-rhel9 v4.14.0-202405161337.p0.gb0c0321.assembly.stream.el9, openshift4/ose-haproxy-router v4.14.0-202405171809.p0.g99b0c31.assembly.stream.el8, +22 morenot affected: vulnerable code not present
+3 more productsfewer
Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202405201956-0, openshift4/ose-tests v4.15.0-202405161507.p0.g043979c.assembly.stream.el8, openshift4/ose-console v4.15.0-202405211136.p0.g589e227.assembly.stream.el8, openshift4/ose-installer v4.15.0-202405211907.p0.g9166886.assembly.stream.el8, openshift4/ose-pod-rhel9 v4.15.0-202405161507.p0.g416ecaf.assembly.stream.el9, openshift4/ose-sdn-rhel9 v4.15.0-202405161507.p0.g71a6f28.assembly.stream.el9, +139 more Red Hat Satellite 6.15 for RHEL 8 foreman 3.9.1.10-1.el8sat, satellite 6.15.4-2.el8sat, python-django 4.2.15-1.el8pc, foreman-cli 3.9.1.10-1.el8sat, foreman-ec2 3.9.1.10-1.el8sat, foreman-pcp 3.9.1.10-1.el8sat, +29 more Red Hat RHUI 4 for RHEL 8 libcomps 0.1.21-1.el8ui, python-jq 1.6.0-4.el8ui, python-xlrd 2.0.1-9.el8ui, python-xlwt 1.3.0-7.el8ui, python-yarl 1.8.2-5.el8ui, python-zipp 3.4.0-8.el8ui, +196 more
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
3.00% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N |
| OSV | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | gunicorn | <22.0.0 |
22.0.0 |
Affected products
- benoitc benoitc/gunicorn
- benoitc gunicorn
Classification
- Weakness
-
- CWE-444 Inconsistent Interpretation of HTTP Requests
References
-
github.com
/benoitc/gunicorn/pull/3113
web
-
github.com
/benoitc/gunicorn/commit/ac29c9b0a758d21f1e0fb3b3457239e523fa9f1d
web
-
huntr.com
/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1
web
-
lists.debian.org
/debian-lts-announce/2024/06/msg00027.html
web
-
lists.debian.org
/debian-lts-announce/2024/12/msg00018.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-1135
advisory
-
github.com
/benoitc/gunicorn/issues/3091
web
-
github.com
/benoitc/gunicorn
package
-
github.com
/benoitc/gunicorn/releases/tag/22.0.0
web
-
pypi.org
/project/gunicorn
package
-
github.com
/advisories/GHSA-w3h3-4rj7-4ph4
advisory
Sources
- CVE List CVE-2024-1135
- GitHub Advisory GHSA-w3h3-4rj7-4ph4
- NVD CVE-2024-1135
- OSV PYSEC-2026-1434
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.