High
gunicorn — security advisory
Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.
- Products
- gunicorn
- Affected versions
- 17.5-2, 17.5-2build1, 17.5-2ubuntu0.1~esm1, 19.0-8ubuntu1, 19.4.1-1ubuntu1, 19.4.5-1ubuntu1, 19.4.5-1ubuntu1.1, 19.7.1-3, 19.7.1-4, 19.9.0-1, 19.9.0-4, 20.0.0-1, 20.0.2-1, 20.0.4-1, 20.0.4-2, 20.0.4-3, 20.1.0-1, 20.1.0-2, 20.1.0-6, 20.1.0-6ubuntu0.1, 23.0.0-1, 23.0.0-1build1, 25.0.3-2, 25.1.0-1, 25.3.0-2, 25.3.0-3, 25.3.0-4
- Fixed versions
- Not specified
- CVEs
- CVE-2024-6827
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:11 UTC · Revision 1
Source evidence
Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.
osv:UBUNTU-CVE-2024-6827
gunicorn
Fixed versions: Not specified
gunicorn
Fixed versions: Not specified
gunicorn
Fixed versions: Not specified
gunicorn
Fixed versions: Not specified
gunicorn
Fixed versions: Not specified
gunicorn
Fixed versions: Not specified
gunicorn
Fixed versions: Not specified
gunicorn
Fixed versions: Not specified
gunicorn
Fixed versions: Not specified
Complete source record
{
"id": "732ba385fe500cd0734d76b49d6be87261cd766e8fa25ab46a80f8ef71cddffe",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-6827",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2024-6827",
"summary": "Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.",
"evidence": "osv:UBUNTU-CVE-2024-6827",
"products": [
{
"name": {
"value": "gunicorn",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "17.5-2",
"evidence": "/affected/0/versions"
},
{
"value": "17.5-2build1",
"evidence": "/affected/0/versions"
},
{
"value": "17.5-2ubuntu0.1~esm1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "gunicorn",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "19.0-8ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "19.4.1-1ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "19.4.5-1ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "19.4.5-1ubuntu1.1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "gunicorn",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "19.7.1-3",
"evidence": "/affected/2/versions"
},
{
"value": "19.7.1-4",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "gunicorn",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "19.9.0-1",
"evidence": "/affected/3/versions"
},
{
"value": "19.9.0-4",
"evidence": "/affected/3/versions"
},
{
"value": "20.0.0-1",
"evidence": "/affected/3/versions"
},
{
"value": "20.0.2-1",
"evidence": "/affected/3/versions"
},
{
"value": "20.0.4-1",
"evidence": "/affected/3/versions"
},
{
"value": "20.0.4-2",
"evidence": "/affected/3/versions"
},
{
"value": "20.0.4-3",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "gunicorn",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "20.1.0-1",
"evidence": "/affected/4/versions"
},
{
"value": "20.1.0-2",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "gunicorn",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "20.1.0-6",
"evidence": "/affected/5/versions"
},
{
"value": "20.1.0-6ubuntu0.1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "gunicorn",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "23.0.0-1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "gunicorn",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "25.1.0-1",
"evidence": "/affected/7/versions"
},
{
"value": "25.3.0-2",
"evidence": "/affected/7/versions"
},
{
"value": "25.3.0-3",
"evidence": "/affected/7/versions"
},
{
"value": "25.3.0-4",
"evidence": "/affected/7/versions"
}
]
},
{
"name": {
"value": "gunicorn",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "23.0.0-1",
"evidence": "/affected/8/versions"
},
{
"value": "23.0.0-1build1",
"evidence": "/affected/8/versions"
},
{
"value": "25.0.3-2",
"evidence": "/affected/8/versions"
},
{
"value": "25.1.0-1",
"evidence": "/affected/8/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2024-6827",
"aliases": [
"UBUNTU-CVE-2024-6827"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "gunicorn",
"purl": "pkg:deb/ubuntu/gunicorn?arch=source&distro=esm-infra-legacy%2Ftrusty",
"ecosystem": "Ubuntu:Pro:14.04:LTS"
},
"versions": [
"17.5-2",
"17.5-2build1",
"17.5-2ubuntu0.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-6827.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gunicorn",
"binary_version": "17.5-2ubuntu0.1~esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "gunicorn",
"purl": "pkg:deb/ubuntu/gunicorn?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"19.0-8ubuntu1",
"19.4.1-1ubuntu1",
"19.4.5-1ubuntu1",
"19.4.5-1ubuntu1.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-6827.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gunicorn",
"binary_version": "19.4.5-1ubuntu1.1"
},
{
"binary_name": "gunicorn-examples",
"binary_version": "19.4.5-1ubuntu1.1"
},
{
"binary_name": "gunicorn3",
"binary_version": "19.4.5-1ubuntu1.1"
},
{
"binary_name": "python-gunicorn",
"binary_version": "19.4.5-1ubuntu1.1"
},
{
"binary_name": "python3-gunicorn",
"binary_version": "19.4.5-1ubuntu1.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "gunicorn",
"purl": "pkg:deb/ubuntu/gunicorn?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"19.7.1-3",
"19.7.1-4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-6827.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gunicorn",
"binary_version": "19.7.1-4"
},
{
"binary_name": "gunicorn-examples",
"binary_version": "19.7.1-4"
},
{
"binary_name": "gunicorn3",
"binary_version": "19.7.1-4"
},
{
"binary_name": "python-gunicorn",
"binary_version": "19.7.1-4"
},
{
"binary_name": "python3-gunicorn",
"binary_version": "19.7.1-4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "gunicorn",
"purl": "pkg:deb/ubuntu/gunicorn?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"19.9.0-1",
"19.9.0-4",
"20.0.0-1",
"20.0.2-1",
"20.0.4-1",
"20.0.4-2",
"20.0.4-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-6827.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gunicorn",
"binary_version": "20.0.4-3"
},
{
"binary_name": "gunicorn-examples",
"binary_version": "20.0.4-3"
},
{
"binary_name": "python3-gunicorn",
"binary_version": "20.0.4-3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "gunicorn",
"purl": "pkg:deb/ubuntu/gunicorn?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"20.1.0-1",
"20.1.0-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-6827.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gunicorn",
"binary_version": "20.1.0-2"
},
{
"binary_name": "gunicorn-examples",
"binary_version": "20.1.0-2"
},
{
"binary_name": "python3-gunicorn",
"binary_version": "20.1.0-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "gunicorn",
"purl": "pkg:deb/ubuntu/gunicorn?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"20.1.0-6",
"20.1.0-6ubuntu0.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-6827.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gunicorn",
"binary_version": "20.1.0-6ubuntu0.1"
},
{
"binary_name": "gunicorn-examples",
"binary_version": "20.1.0-6ubuntu0.1"
},
{
"binary_name": "python3-gunicorn",
"binary_version": "20.1.0-6ubuntu0.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "gunicorn",
"purl": "pkg:deb/ubuntu/gunicorn?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"23.0.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-6827.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gunicorn",
"binary_version": "23.0.0-1"
},
{
"binary_name": "gunicorn-examples",
"binary_version": "23.0.0-1"
},
{
"binary_name": "python3-gunicorn",
"binary_version": "23.0.0-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "gunicorn",
"purl": "pkg:deb/ubuntu/gunicorn?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"25.1.0-1",
"25.3.0-2",
"25.3.0-3",
"25.3.0-4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-6827.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gunicorn",
"binary_version": "25.3.0-4"
},
{
"binary_name": "gunicorn-examples",
"binary_version": "25.3.0-4"
},
{
"binary_name": "python3-gunicorn",
"binary_version": "25.3.0-4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "gunicorn",
"purl": "pkg:deb/ubuntu/gunicorn?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"23.0.0-1",
"23.0.0-1build1",
"25.0.3-2",
"25.1.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-6827.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "gunicorn",
"binary_version": "25.1.0-1"
},
{
"binary_name": "gunicorn-examples",
"binary_version": "25.1.0-1"
},
{
"binary_name": "python3-gunicorn",
"binary_version": "25.1.0-1"
}
]
}
}
],
"modified": "2026-10-17T12:56:42.102181516Z",
"provider": "osv",
"upstream": [
"CVE-2024-6827"
],
"references": [
"https://ubuntu.com/security/CVE-2024-6827",
"https://www.cve.org/CVERecord?id=CVE-2024-6827",
"https://huntr.com/bounties/1b4f8f38-39da-44b6-9f98-f618639d0dd7"
]
},
"related_cves": [
{
"value": "CVE-2024-6827",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 355988,
"published_at": "2025-03-20T10:15:00+00:00"
}