Inconsistent interpretation of HTTP requests in Gunicorn - CVE-2024-6827

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU107611

Inconsistent interpretation of HTTP requests in Gunicorn - CVE-2024-6827

Published: April 18, 2025


Vulnerability identifier: #VU107611
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-6827
CWE-ID: CWE-444
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to Gunicorn does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. A remote attacker can send a specially crafted HTTP request to the server and initiate cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.


Affected software

Gunicorn
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
Public Cloud Module
Python 3 Module
openSUSE Leap
openEuler
IBM Cloud Pak for Data System
IBM Observability with Instana
IBM Fusion HCI
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Business Automation Workflow
App Connect Enterprise Certified Container
Rapid Infrastructure Automation
watsonx Orchestrate Developer Edition
Storage Defender - Resiliency Service
Security QRadar EDR
Knowledge Catalog Premium Cartridge
Maximo Application Suite - Monitor Component
IBM Security QRadar Network Threat Analytics
Telco Service Design Configuration Designer
Telco Network Function Virtualization Orchestrator
watsonx.data
python3-gunicorn
python-gunicorn
python-gunicorn-help
python311-gunicorn

How to mitigate CVE-2024-6827

Install updates from vendor's website.

Gunicorn - update to 22.0.0
IBM Cloud Pak for Data System - update to 1.0.9.0
IBM Observability with Instana - update to 1.0.307
Rapid Infrastructure Automation - update to 1.1.5.3
watsonx Orchestrate Developer Edition - update to 2.0.0
Storage Defender - Resiliency Service - update to 2.0.13
IBM Fusion HCI - update to 2.10.0
watsonx.data - update to 2.2.1
Security QRadar EDR - update to 3.12.18
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.9, 5.1.3
Knowledge Catalog Premium Cartridge - update to 5.2
Maximo Application Suite - Monitor Component - addressed in versions 8.10.20, 8.11.18, 9.0.10, 9.1.0
IBM Business Automation Workflow - update to 24.0.0-IF006
IBM Security QRadar Network Threat Analytics - update to 1.4.0
Telco Service Design Configuration Designer - update to 2.3.0
Telco Network Function Virtualization Orchestrator - update to 7.3.0
App Connect Enterprise Certified Container - addressed in versions 12.0.11, 12.11.0
python3-gunicorn - update to 19.7.1-150000.3.10.1
python-gunicorn - addressed in versions 20.1.0-2, 21.2.0-2
python-gunicorn-help - addressed in versions 20.1.0-2, 21.2.0-2
python3-gunicorn - addressed in versions 20.1.0-2, 21.2.0-2
python311-gunicorn - update to 20.1.0-150400.12.9.1

External References

Related Security Bulletins