https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 08:01:49 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-06308 bdu:2024-06308 https://cve.radiocsirt.org/vuln/bdu:2024-06308 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0512 certfr-2025-avi-0512 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0512 https://cve.radiocsirt.org/vuln/euvd-2026-255086 EUVD-2026-255086 https://cve.radiocsirt.org/vuln/euvd-2026-255086 https://cve.radiocsirt.org/vuln/fkie_cve-2024-6827 <p>Gunicorn version 21.2.0 does not properly validate the value of the &#39;Transfer-Encoding&#39; header as specified in the RFC standards, which leads to the default fallback method of &#39;Content-Length,&#39; making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.</p> <p>Gunicorn version 21.2.0 does not properly validate the value of the &#39;Transfer-Encoding&#39; header as specified in the RFC standards, which leads to the default fallback method of &#39;Content-Length,&#39; making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-6827 https://cve.radiocsirt.org/vuln/ghsa-hc5x-x2vx-497g <p><strong>Affected:</strong> PyPI: gunicorn</p> <p>Gunicorn version 21.2.0 does not properly validate the value of the &#39;Transfer-Encoding&#39; header as specified in the RFC standards, which leads to the default fallback method of &#39;Content-Length,&#39; making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.</p> <p><strong>Affected:</strong> PyPI: gunicorn</p> <p>Gunicorn version 21.2.0 does not properly validate the value of the &#39;Transfer-Encoding&#39; header as specified in the RFC standards, which leads to the default fallback method of &#39;Content-Length,&#39; making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.</p> https://cve.radiocsirt.org/vuln/ghsa-hc5x-x2vx-497g https://cve.radiocsirt.org/vuln/oesa-2026-3657 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP3: python-gunicorn</p> <p>Gunicorn(Green Unicorn) is a Python WSGI HTTP Server for UNIX. It&amp;amp;apos;s a pre-fork worker model ported from Ruby&amp;amp;apos;s Unicorn_ project. The Gunicorn server is broadly compatible with various web frameworks, simply implemented, light on server resource usage, and fairly speedy. Security Fix(es):</p> <p>Gunicorn version 21.2.0 does not properly validate the value of the &amp;apos;Transfer-Encoding&amp;apos; header as specified in the RFC standards, which leads to the default fallback method of &amp;apos;Content-Length,&amp;apos; making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.(CVE-2024-6827)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP3: python-gunicorn</p> <p>Gunicorn(Green Unicorn) is a Python WSGI HTTP Server for UNIX. It&amp;amp;apos;s a pre-fork worker model ported from Ruby&amp;amp;apos;s Unicorn_ project. The Gunicorn server is broadly compatible with various web frameworks, simply implemented, light on server resource usage, and fairly speedy. Security Fix(es):</p> <p>Gunicorn version 21.2.0 does not properly validate the value of the &amp;apos;Transfer-Encoding&amp;apos; header as specified in the RFC standards, which leads to the default fallback method of &amp;apos;Content-Length,&amp;apos; making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.(CVE-2024-6827)</p> https://cve.radiocsirt.org/vuln/oesa-2026-3657 https://cve.radiocsirt.org/vuln/pysec-2026-1433 <p><strong>Affected:</strong> PyPI: gunicorn</p> <p>Gunicorn version 21.2.0 does not properly validate the value of the &#39;Transfer-Encoding&#39; header as specified in the RFC standards, which leads to the default fallback method of &#39;Content-Length,&#39; making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.</p> <p><strong>Affected:</strong> PyPI: gunicorn</p> <p>Gunicorn version 21.2.0 does not properly validate the value of the &#39;Transfer-Encoding&#39; header as specified in the RFC standards, which leads to the default fallback method of &#39;Content-Length,&#39; making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1433 https://cve.radiocsirt.org/vuln/rhba-2025:3651 <p>gunicorn: HTTP Request Smuggling in benoitc/gunicorn golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh jinja2: Jinja sandbox breakout through attr filter selecting format method</p> <p>gunicorn: HTTP Request Smuggling in benoitc/gunicorn golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh jinja2: Jinja sandbox breakout through attr filter selecting format method</p> https://cve.radiocsirt.org/vuln/rhba-2025:3651 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-6827 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: gunicorn, Ubuntu:16.04:LTS: gunicorn, Ubuntu:18.04:LTS: gunicorn, Ubuntu:20.04:LTS: gunicorn, Ubuntu:22.04:LTS: gunicorn, Ubuntu:24.04:LTS: gunicorn, Ubuntu:25.10: gunicorn, Ubuntu:26.04:LTS: gunicorn</p> <p>Gunicorn version 21.2.0 does not properly validate the value of the &#39;Transfer-Encoding&#39; header as specified in the RFC standards, which leads to the default fallback method of &#39;Content-Length,&#39; making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: gunicorn, Ubuntu:16.04:LTS: gunicorn, Ubuntu:18.04:LTS: gunicorn, Ubuntu:20.04:LTS: gunicorn, Ubuntu:22.04:LTS: gunicorn, Ubuntu:24.04:LTS: gunicorn, Ubuntu:25.10: gunicorn, Ubuntu:26.04:LTS: gunicorn</p> <p>Gunicorn version 21.2.0 does not properly validate the value of the &#39;Transfer-Encoding&#39; header as specified in the RFC standards, which leads to the default fallback method of &#39;Content-Length,&#39; making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-6827 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0998 <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Dateien zu manipulieren, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Dateien zu manipulieren, vertrauliche Informationen preiszugeben und einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0998