The vulnerability of the WSGI-server Gunicorn, related to defects in HTTP request processing, allows attackers to circumvent existing security restrictions and execute a “HTTP request hijacking” attack.

🗓️ 07 May 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Gunicorn WSGI server flaw in HTTP processing enables bypassing security and hijacking requests.

Reporter	Title	Published	Views	Family All 104
IBM Security Bulletins	Security Bulletin: IBM Security QRadar EDR Software contains multiple vulnerabilities	8 Jul 202409:49	–	ibm
IBM Security Bulletins	Security Bulletin: User Behavior Analytics application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	20 Nov 202413:56	–	ibm
IBM Security Bulletins	Security Bulletin: gunicorn-20.1.0-py3-none-any	2 Aug 202408:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift	15 Apr 202502:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to HTTP Request Smuggling due to Gunicorn ( CVE-2024-1135 )	3 Jun 202505:37	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Advisor With Watson for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	17 Mar 202513:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in Gunicorn	26 Feb 202518:43	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo Application Suite - gunicorn-20.1.0-py3-none-any.whl is vulnerable to CVE-2024-1135 used in IBM Maximo Application Suite - Monitor Component	25 Jun 202422:05	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	3 May 202410:32	–	ibm
IBM Security Bulletins	Security Bulletin: Gunicorn-20.1.0-py3-none-any.whl is vulnerable to CVE-2024-1135 used in IBM Maximo Application Suite - Edge Data Collector	3 Jun 202412:13	–	ibm

Vulners

Node

red_hat red_hat_storageMatch3

OR

red_hat red_hat_quayMatch3

OR

red_hat red_hat_openshift_container_platformMatch4

OR

red_hat red_hat_satelliteMatch6

OR

red_hat red_hat_openstack_platformMatch16.2

OR

red_hat red_hat_openstack_platformMatch16.1

OR

red_hat red_hat_update_infrastructure_for_cloud_providersMatch4

OR

red_hat red_hat_ansible_automation_platformMatch2

OR

red_hat red_hat_openstack_platformMatch17.1

OR

red_hat red_hat_enterprise_linuxMatch7

OR

novell opensuse_leapMatch15.5

Source	Link
huntr	www.huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1
github	www.github.com/benoitc/gunicorn/commit/ac29c9b0a758d21f1e0fb3b3457239e523fa9f1d
github	www.github.com/advisories/GHSA-w3h3-4rj7-4ph4
github	www.github.com/benoitc/gunicorn/releases
suse	www.suse.com/security/cve/CVE-2024-1135.html
access	www.access.redhat.com/security/cve/CVE-2024-1135
security-tracker	www.security-tracker.debian.org/tracker/CVE-2024-1135
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.11/
altsp	www.altsp.su/obnovleniya-bezopasnosti/
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/

26 Aug 2025 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 37.5

CVSS 27.8

EPSS0.02996

Gunicorn web server flaw request processing security bypass request hijacking