CVE-2024-1135
HighAdvisory
Published 16 Apr 2024In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.2
- base score, highest
- EPSS
- 0.030
- 87th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 126
- of 17,781 indexed, latest versions
- Container images
- 137
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Request smuggling leading to endpoint restriction bypass in Gunicorn
Carried by container images the latest versions of 126 of 17,781 indexed charts deploy, on 137 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| gunicornpypi | 19.6.0, 19.7.1, 19.8.0, 19.8.1+5 more | 22.0.0 | 137 |
- OSV records
- GHSA-w3h3-4rj7-4ph4
- Also known as
- PYSEC-2026-1434
Charts affected
126 by stars
Container images carrying it
137 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| geoscienceaustralia/ | f4039b45572a | gunicorn | 22.0.0 | 1 |
| gethue/ | 11b649636e68 | gunicorn | 22.0.0 | 1 |
| gethue/ | 5702b2c37ff9 | gunicorn | 22.0.0 | 1 |
| gmaas2/ | 148fc2d9afe9 | gunicorn | 22.0.0 | 1 |
| graphiteapp/ | 04a0037cc2ae | gunicorn | 22.0.0 | 1 |
| ha33ona/ | 6affdfc644d0 | gunicorn | 22.0.0 | 1 |
| halkeye/ | 77b05e95fdb5 | gunicorn | 22.0.0 | 1 |
| hhyo/ | 1aa41843419e | gunicorn | 22.0.0 | 1 |
| hkotel/ | a7e6b6abe087 | gunicorn | 22.0.0 | 1 |
| i4trust/ | 9f3719176893 | gunicorn | 22.0.0 | 1 |
| ihatemoney/ | 457fda1feb32 | gunicorn | 22.0.0 | 1 |
| improwised/ | 97280b55cbd4 | gunicorn | 22.0.0 | 1 |
| intel/ | 1a89327e499b | gunicorn | 22.0.0 | 1 |
| irakli/ | 9e7a91ba9ae0 | gunicorn | 22.0.0 | 1 |
| istio/ | 328b237e4fb1 | gunicorn | 22.0.0 | 1 |
| istio/ | 0a7f02b2c7c9 | gunicorn | 22.0.0 | 1 |
| jakuboskera/ | 4989afa06e74 | gunicorn | 22.0.0 | 1 |
| jakuboskera/ | 714b1adbbc2d | gunicorn | 22.0.0 | 1 |
| julb/ | 837c4038a0dd | gunicorn | 22.0.0 | 1 |
| julb/ | 0806409af397 | gunicorn | 22.0.0 | 1 |
| kelvinsp/ | cd33e6db2a59 | gunicorn | 22.0.0 | 1 |
| kennethreitz/ | 599fe5e50731 | gunicorn | 22.0.0 | 1 |
| kfserving/ | f322d6ffdfa3 | gunicorn | 22.0.0 | 1 |
| kserve/ | 63ea05e73842 | gunicorn | 22.0.0 | 1 |
| kubeflownotebookswg/ | d762690e21c1 | gunicorn | 22.0.0 | 1 |
| kubeflownotebookswg/ | 0876fef1973b | gunicorn | 22.0.0 | 1 |
| kubeflownotebookswg/ | 7299fa94db15 | gunicorn | 22.0.0 | 1 |
| linuxserver/ | f7d7c7704249 | gunicorn | 22.0.0 | 1 |
| lsstsqre/ | 79b00fb67a65 | gunicorn | 22.0.0 | 1 |
| marcinkujawski/ | a455017b9d0e | gunicorn | 22.0.0 | 1 |
| milesmcc/ | ba54f7797a6b | gunicorn | 22.0.0 | 1 |
| milesmcc/ | e821e31140f7 | gunicorn | 22.0.0 | 1 |
| miltex/ | dab12a7748d5 | gunicorn | 22.0.0 | 1 |
| mondata/ | 6f94c6caf8bf | gunicorn | 22.0.0 | 1 |
| mozilla/ | 016162bf39d8 | gunicorn | 22.0.0 | 1 |
| mshanley80/ | 5b189a70c0fb | gunicorn | 22.0.0 | 1 |
| mvitale1989/ | 1504ccda06df | gunicorn | 22.0.0 | 1 |
| netboxcommunity/ | 3d652dca5351 | gunicorn | 22.0.0 | 1 |
| ngoduykhanh/ | 099371dd9ba6 | gunicorn | 22.0.0 | 1 |
| ngoduykhanh/ | 9898a7cf37d2 | gunicorn | 22.0.0 | 1 |
| opendatacube/ | 91870111837c | gunicorn | 22.0.0 | 1 |
| opendatacube/ | 1b90cdf68831 | gunicorn | 22.0.0 | 1 |
| openelevation/ | 82fb21612e86 | gunicorn | 22.0.0 | 1 |
| pschiffe/ | 37ebba8c2b8f | gunicorn | 22.0.0 | 1 |
| pypiserver/ | e935e19433ef | gunicorn | 22.0.0 | 1 |
| redash/ | 9392753c0376 | gunicorn | 22.0.0 | 1 |
| seafileltd/ | 6693911bcc40 | gunicorn | 22.0.0 | 1 |
| seafileltd/ | 70628f29c663 | gunicorn | 22.0.0 | 1 |
| seafileltd/ | 7ac833196f60 | gunicorn | 22.0.0 | 1 |
| seafileltd/ | d0c66e4621bd | gunicorn | 22.0.0 | 1 |