id: PYSEC-2026-1433
published: "2026-07-07T14:34:55.125128Z"
modified: "2026-07-07T17:24:17.093489Z"
aliases:
- CVE-2024-6827
- GHSA-hc5x-x2vx-497g
summary: Gunicorn HTTP Request/Response Smuggling vulnerability
details: Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.
affected:
- package:
    name: gunicorn
    ecosystem: PyPI
    purl: pkg:pypi/gunicorn
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 22.0.0
  versions:
  - "0.1"
  - 0.10.0
  - 0.10.1
  - 0.11.0
  - 0.11.1
  - 0.11.2
  - 0.12.0
  - 0.12.1
  - 0.12.2
  - 0.13.0
  - 0.13.1
  - 0.13.2
  - 0.13.3
  - 0.13.4
  - 0.14.0
  - 0.14.1
  - 0.14.2
  - 0.14.3
  - 0.14.4
  - 0.14.5
  - 0.14.6
  - 0.15.0
  - 0.16.0
  - 0.16.1
  - 0.17.0
  - 0.17.1
  - 0.17.2
  - 0.17.3
  - 0.17.4
  - "0.2"
  - 0.2.1
  - "0.3"
  - 0.3.1
  - 0.3.2
  - "0.4"
  - 0.4.1
  - 0.4.2
  - "0.5"
  - 0.5.1
  - "0.6"
  - 0.6.1
  - 0.6.2
  - 0.6.3
  - 0.6.4
  - 0.6.5
  - 0.6.6
  - 0.7.0
  - 0.7.1
  - 0.7.2
  - 0.8.0
  - 0.8.1
  - 0.9.0
  - 0.9.1
  - "17.5"
  - "18.0"
  - 19.0.0
  - 19.1.0
  - 19.1.1
  - 19.10.0
  - 19.2.0
  - 19.2.1
  - 19.3.0
  - 19.4.0
  - 19.4.1
  - 19.4.2
  - 19.4.3
  - 19.4.4
  - 19.4.5
  - 19.5.0
  - 19.6.0
  - 19.7.0
  - 19.7.1
  - 19.8.0
  - 19.8.1
  - 19.9.0
  - 20.0.0
  - 20.0.1
  - 20.0.2
  - 20.0.3
  - 20.0.4
  - 20.1.0
  - 21.0.0
  - 21.0.1
  - 21.1.0
  - 21.2.0
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2024-6827
- type: WEB
  url: https://github.com/benoitc/gunicorn/issues/3087
- type: WEB
  url: https://github.com/benoitc/gunicorn/issues/3278
- type: WEB
  url: https://github.com/benoitc/gunicorn/pull/3113
- type: PACKAGE
  url: https://github.com/benoitc/gunicorn
- type: WEB
  url: https://github.com/benoitc/gunicorn/releases/tag/22.0.0
- type: WEB
  url: https://huntr.com/bounties/1b4f8f38-39da-44b6-9f98-f618639d0dd7
- type: PACKAGE
  url: https://pypi.org/project/gunicorn
- type: ADVISORY
  url: https://github.com/advisories/GHSA-hc5x-x2vx-497g
severity:
- type: CVSS_V3
  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N