AIKIDO-2025-10247

TL;DR

Affected versions are vulnerable to HTTP request smuggling when using the gevent_wsgi or gevent_pywsgi worker classes. The issue stems from gevent’s PyWSGIHandler, where the EXPECT: 100-continue header causes the server to retain extra bytes in the socket buffer. These bytes are then interpreted as a new HTTP request, even if forwarded as part of an earlier one. This allows attackers to smuggle unauthorized requests—such as accessing /admin while only /api is exposed via a reverse proxy. The vulnerability can lead to serious security issues such as cache poisoning, data exposure, session hijacking, SSRF, cross-site scripting, and other impacts typical of HTTP request smuggling attacks.