UnratedFix available
Gunicorn 25.3.0
Gunicorn 25.3.0 adds ASGI parser header validation checks that reject potentially unsafe or invalid HTTP request headers and transfer-encoding combinations.
Announced Group revision 1
Original source ↗github-benoitc-gunicorn
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
Security ASGI Parser Header Validation: Add security checks per RFC 9110/9112: Reject duplicate Content-Length headers Reject requests with both Content-Length and Transfer-Encoding Reject chunked transfer encoding in HTTP/1.0 Reject stacked chunked encoding Validate Transfer-Encoding values Strict chunk size validation
Gunicorn
Release notes from gunicorn Gunicorn 25.3.0
- Affected versions
- Not stated in this extraction
- Fixed versions
- 25.3.0
Gunicorn 25.3.0
- Prerequisites
- Not stated in this extraction
Publisher severity
No explicit severity was extracted.
- Event
- #79828 · Revision 1
- Added to Heist Feed
- Publisher date