HIGHCVSS 8.7EPSS 2.4%

CVE-2018-1000164

Gunicorn contains Improper Neutralization of CRLF sequences in HTTP headers

Published: 2018-07-12
Modified: 2026-09-08
EPSS percentile: 83%
Aliases: GHSA-32pc-xphx-q4f6
Sources: github-advisory

Summary

gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
PyPI	gunicorn	—	19.5.0

Remediation: Upgrade to 19.5.0 or later.

References

https://github.com/advisories/GHSA-32pc-xphx-q4f6

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.