AIKIDO-2026-10742
gunicorn is vulnerable to HTTP Request Smuggling
87
High Risk
This Affects:
gunicornTL;DR
gunicorn terminates HTTP for Python apps using combined Python/C parsers plus shared framing helpers for HTTP/1.x and HTTP/2-over-ASGI paths. Weak acceptance rules around request-target forms, header and trailer field-values, and keep-alive body lifecycle boundaries allowed inconsistent interpretations aligned with classic request-smuggling and header-framing hazard patterns. PROXY protocol handling could stray outside administrator-controlled trusted-proxy constraints without tighter parsing and IP validation. The release tightens RFC-driven rejects for malformed targets and forbidden trailers, narrows header octets and framing transitions that gates reuse pipelining paths, hardens PROXY parsing alongside allowlisting semantics, drains sockets cooperatively on close, and aligns helper validations such as early hints with core header processing.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
gunicorn is vulnerable to HTTP Request Smuggling in versions 0.1 - 25.3.0.
How to fix this
Upgrade the gunicorn library to the patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant