Gunicorn Vulnerability Allows HTTP Request Smuggling

CVE-2024-1135

What is CVE-2024-1135?

Gunicorn, a popular Python WSGI HTTP server, has a vulnerability that arises from improper validation of Transfer-Encoding headers. This flaw facilitates HTTP Request Smuggling (HRS) attacks, wherein attackers are capable of crafting requests that include conflicting Transfer-Encoding headers. Due to Gunicorn's flawed processing of these headers, requests may be treated as chunked, irrespective of the actual encoding specified. This oversight allows malicious actors to potentially bypass security measures, access restricted endpoints, perform session manipulation, engage in cache poisoning, and expose sensitive data, posing significant risks to applications relying on Gunicorn for handling web traffic.

References