Vulnerability in Benoitc Benoitc/gunicorn
CVE-2024-6827
Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.
Vulnerability class: HTTP Request Smuggling
EPSS: 0.007 (50.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Benoitc Benoitc/gunicorn — versions unspecified
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2024-6827?
- CVE-2024-6827 is a high-severity vulnerability in Benoitc Benoitc/gunicorn, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 7.5/10. Published 2025-03-20.
- How severe is CVE-2024-6827?
- High severity. CVSS v3 base score is 7.5 out of 10.