CVE-2024-1135 HTTP Request Smuggling in benoitc/gunicorn
Attackers can exploit HTTP request smuggling in Gunicorn to bypass security restrictions, access restricted endpoints, and expose sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-1135?
CVE-2024-1135 is a high-severity vulnerability in benoitc/gunicorn, published on 16 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks including cache poisoning, session manipulation, and data exposure.
Weakness: CWE-444
Which versions are affected by CVE-2024-1135?
3 open source packages ship an affected version, including gunicorn.
| Package | Affected | Fixed in |
|---|---|---|
gunicorn PyPI | All versions | 22.0.0 |
gunicorn PyPI | All versions | 22.0.0 |
gunicorn PyPI | All versions | 22.0.0 |
Linux distribution packages (16)
python-gunicorn Red Hat:openstack:16.2::el8 | All versions | 0:19.9.0-11.el8ost |
python3-gunicorn Red Hat:openstack:16.2::el8 | All versions | 0:19.9.0-11.el8ost |
python-gunicorn Red Hat:openstack:17.1::el9 | All versions | 0:20.0.4-7.el9ost |
python3-gunicorn Red Hat:openstack:17.1::el9 | All versions | 0:20.0.4-7.el9ost |
python-gunicorn SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 20.1.0-150400.12.6.1 |
python-gunicorn SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 20.1.0-150400.12.6.1 |
python-gunicorn SUSE:Linux Enterprise Module for Public Cloud 15 SP2 | All versions | 19.7.1-150000.3.7.1 |
python-gunicorn SUSE:Linux Enterprise Module for Public Cloud 15 SP3 | All versions | 19.7.1-150000.3.7.1 |
python-gunicorn SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 19.7.1-150000.3.7.1 |
python-gunicorn SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | All versions | 19.7.1-150000.3.7.1 |
python-gunicorn SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | All versions | 19.7.1-150000.3.7.1 |
python-gunicorn SUSE:Linux Enterprise Module for Python 3 15 SP5 | All versions | 20.1.0-150400.12.6.1 |
python-gunicorn SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 20.1.0-150400.12.6.1 |
python-gunicorn SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 20.1.0-150400.12.6.1 |
python-gunicorn openSUSE:Leap 15.5 | All versions | 19.7.1-150000.3.7.1 |
python-gunicorn openSUSE:Leap 15.5 | All versions | 20.1.0-150400.12.6.1 |
How do I fix CVE-2024-1135?
Upgrade gunicorn to 22.0.0 or later.
Is CVE-2024-1135 being exploited?
There is no known exploitation of CVE-2024-1135 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1787306646, DEBIAN-CVE-2024-1135, DLA-3851-1, DLA-3996-1, ECHO-9a6c-5607-fd1b, GHSA-w3h3-4rj7-4ph4 and 10 more.