CVE-2018-1000164High· 7.5▾ TwilightGunicorn contains Improper Neutralization of CRLF sequences in HTTP headers
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.5 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
2.4%
2.4% → 2.5%
gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.
gunicorn < 19.5.0Upgrade to a patched release:
gunicorn 19.5.0Connected by shared product, vendor, weakness, or advisory.
CVE-2024-1135High· 8.2Request smuggling leading to endpoint restriction bypass in Gunicorn
CVE-2024-6827High· 7.5Gunicorn HTTP Request/Response Smuggling vulnerability
CVE-2024-58384Medium· 5.4Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers
CVE-2026-84379Medium· 5.3HTTPX2 is a next generation HTTP client for Python
CVE-2026-67326High· 7.0GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config
CVE-2026-53533Mediumaiosmtplib is an asynchronous SMTP client for use with asyncio