UnratedFix available
gunicorn 26.2.0
gunicorn 26.2.0 fixes HTTP/2 request validation gaps by applying the HTTP/1 policy to HTTP/2 and deriving the scheme from the transport. It also fixes dropped request bodies on ASGI Upgrade requests through a required parser update.
Announced Group revision 1
Original source ↗github-benoitc-gunicorn
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Both request classes now share one policy mixin, and the scheme comes from the transport.
gunicorn
Release notes from gunicorn
- Affected versions
- Not stated in this extraction
- Fixed versions
- 26.2.0
gunicorn 26.2.0
- Prerequisites
- If you serve HTTP/2
If you serve HTTP/2, this is the reason to upgrade.
gunicorn_h1c
Fixed in gunicorn_h1c 0.6.9
- Affected versions
- Not stated in this extraction
- Fixed versions
- 0.6.9
Fixed in gunicorn_h1c 0.6.9
- Prerequisites
- On the ASGI worker with the fast parser
On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body
Publisher severity
No explicit severity was extracted.
- Event
- #79679 · Revision 1
- Added to Heist Feed
- Publisher date