PYSEC-2026-1434

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/gunicorn/PYSEC-2026-1434.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-1434
Aliases
Published
2026-07-07T11:45:38.679382Z
Modified
2026-07-07T17:47:39.221645615Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N CVSS Calculator
Summary
Request smuggling leading to endpoint restriction bypass in Gunicorn
Details

Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability has been shown to allow access to endpoints restricted by gunicorn. This issue has been addressed in version 22.0.0.

To be affected users must have a network path which does not filter out invalid requests. These users are advised to block access to restricted endpoints via a firewall or other mechanism if they are unable to update.

References

Affected packages

PyPI / gunicorn

Package

Name
gunicorn
View open source insights on deps.dev
Purl
pkg:pypi/gunicorn

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
22.0.0

Affected versions

0.*
0.1
0.2
0.2.1
0.3
0.3.1
0.3.2
0.4
0.4.1
0.4.2
0.5
0.5.1
0.6
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.7.0
0.7.1
0.7.2
0.8.0
0.8.1
0.9.0
0.9.1
0.10.0
0.10.1
0.11.0
0.11.1
0.11.2
0.12.0
0.12.1
0.12.2
0.13.0
0.13.1
0.13.2
0.13.3
0.13.4
0.14.0
0.14.1
0.14.2
0.14.3
0.14.4
0.14.5
0.14.6
0.15.0
0.16.0
0.16.1
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
17.*
17.5
18.*
18.0
19.*
19.0.0
19.1.0
19.1.1
19.2.0
19.2.1
19.3.0
19.4.0
19.4.1
19.4.2
19.4.3
19.4.4
19.4.5
19.5.0
19.6.0
19.7.0
19.7.1
19.8.0
19.8.1
19.9.0
19.10.0
20.*
20.0.0
20.0.1
20.0.2
20.0.3
20.0.4
20.1.0
21.*
21.0.0
21.0.1
21.1.0
21.2.0

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/gunicorn/PYSEC-2026-1434.yaml"