AIKIDO-2026-625366

TL;DR

gunicorn's HTTP/2 request handling builds the WSGI environ directly from the HTTP/2 stream and skips the header-validation policy that the HTTP/1 path enforces. Untrusted clients can inject forged and underscore-prefixed HTTP_* environ entries, set SCRIPT_NAME, submit duplicate Host or Content-Type headers and control characters, and choose wsgi.url_scheme through the :scheme pseudo-header. The forwarded_allow_ips trust gate is also bypassed, so forwarding headers from untrusted peers are honored as if they came from a trusted proxy. The fix moves the shared header policy onto a mixin used by both request classes and derives the scheme from the transport unless the peer is trusted.