{
  "cveId": "CVE-2024-6827",
  "url": "https://patchblox.com/security/cve/CVE-2024-6827",
  "summary": "CVE-2024-6827 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2024-6827, released March 20, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "gunicorn: Gunicorn version 21.2.0 does not properly validate the value of the \u0027Transfer-Encoding\u0027 header as specified in the RF...",
  "description": "Gunicorn version 21.2.0 does not properly validate the value of the \u0027Transfer-Encoding\u0027 header as specified in the RFC standards, which leads to the default fallback method of \u0027Content-Length,\u0027 making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.",
  "published": "2025-03-20T10:15:33Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss": 0.00806,
  "epssPercentile": 0.57024,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "gunicorn",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "23.0.0-1",
      "fix": "DEBIAN-CVE-2024-6827",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-6827",
      "released": "2025-03-20T10:15:33Z"
    },
    {
      "platform": "linux",
      "product": "gunicorn",
      "release": "Debian 14",
      "fixedVersion": "23.0.0-1",
      "fix": "DEBIAN-CVE-2024-6827",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-6827",
      "released": "2025-03-20T10:15:33Z"
    },
    {
      "platform": "linux",
      "product": "python-gunicorn",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "20.1.0-150400.12.9.1",
      "fix": "SUSE-SU-2025:1008-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-1008-1",
      "released": "2025-03-25T11:09:00Z"
    },
    {
      "platform": "linux",
      "product": "python-gunicorn",
      "release": "sles 15.6",
      "fixedVersion": "20.1.0-150400.12.9.1",
      "fix": "SUSE-SU-2025:1008-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-1008-1",
      "released": "2025-03-25T11:09:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}