Request Smuggling Vulnerability in Gunicorn by the Vendor

CVE-2024-6827

What is CVE-2024-6827?

Gunicorn version 21.2.0 contains a vulnerability due to improper validation of the 'Transfer-Encoding' header as per RFC standards. This oversight allows the default fallback method of 'Content-Length' to be exploited, leading to request smuggling vulnerabilities. Such vulnerabilities may result in cache poisoning, session manipulation, data leakage, and various attacks including SSRF, XSS, and Denial of Service (DoS), ultimately compromising data integrity and allowing unauthorized security bypasses.

References