AIKIDO-2026-332632
gunicorn is vulnerable to HTTP Request Smuggling
48
Medium Risk
This Affects:
gunicornTL;DR
Gunicorn's HTTP parser accepts messages that are ambiguous under RFC 9110/9112, including requests carrying duplicate Host or Content-Type headers and chunked bodies truncated after the final chunk line. It also keeps connections open after a worker times out and does not strip response body framing on HEAD and 1xx/204/304 replies. Because Gunicorn and an upstream proxy or cache can then disagree on where one message ends and the next begins, a request can be smuggled past front-end controls or a stale response can be served for the wrong request. The fix rejects the ambiguous headers and truncated bodies, closes timed-out connections, and drops forbidden response bodies so message boundaries stay consistent.
Who does this affect?
You are affected if you run a version within the vulnerable range and deploy Gunicorn behind a front-end proxy or cache that can parse externally supplied, ambiguous HTTP messages differently than Gunicorn does.
Background info
gunicorn is vulnerable to HTTP Request Smuggling in versions 0.1.0 - 26.0.0.
How to fix this
Upgrade the gunicorn library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant