CVE-2024-1135

Low

Low Medium High Critical

CVSS Score

Published: Apr 16, 2024

Last Modified: Dec 20, 2024

Vulnerability Description

Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks including cache poisoning, session manipulation, and data exposure.

Available Security Patches

3 patches available from vendors

View All Patches

Oracle

CPUJUL2025

Oracle Critical Patch Update Advisory - July 2025

Severity

Critical

Released

Jul 15, 2025

Restart Required

Security Update

View Details Vendor Page

Oracle

CPUAPR2025

Oracle Critical Patch Update Advisory - April 2025

Severity

Critical

Released

Apr 15, 2025

Restart Required

Security Update

View Details Vendor Page

Oracle

CPUJAN2025

Oracle Critical Patch Update Advisory - January 2025

Severity

Critical

Released

Jan 21, 2025

Restart Required

Security Update

View Details Vendor Page

Browse All Security Patches

References & Resources

Severity Details

out of 10.0

Low

Weakness Type (CWE)

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Description: The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that…
Typical Severity: Medium
Abstraction Level: Base