Veracode Vulnerability DatabaseVERACODE:46453HTTP Request Smuggling (HRS)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
6.9 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
9.1%
gunicorn is vulnerable to HTTP Request Smuggling (HRS). The vulnerability is due to improper processing of Transfer-Encoding headers by treating them as chunked regardless of the specified encoding , which allows attackers to bypass security restrictions and access restricted endpoints by crafting requests containing conflicting Transfer-Encoding headers
| CPE | Name | Operator | Version |
|---|---|---|---|
| gunicorn | le | 21.2.0 | |
| gunicorn:sid | eq | 20.0.4-4 | |
| gunicorn | le | 21.2.0 | |
| gunicorn:sid | eq | 20.0.4-4 |
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
6.9 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
9.1%