{"action":"Upgrade gunicorn to 19.5.0 or later.","affected":[{"fixed":"19.5.0","introduced":"0"}],"component":"gunicorn","cve_ids":["CVE-2018-1000164"],"ecosystem":"PyPI","epss":0.02369,"exploited":false,"fixed_versions":["19.5.0"],"ghsa_id":"GHSA-32pc-xphx-q4f6","id":"tcs_01M5KETKYYHA2KWY0FH5E77143","modified_at":"2026-09-08T15:46:56.599254Z","published_at":"2018-07-12T20:30:49Z","references":["https://osv.dev/vulnerability/GHSA-32pc-xphx-q4f6","https://nvd.nist.gov/vuln/detail/CVE-2018-1000164","https://github.com/benoitc/gunicorn/issues/1227","https://github.com/benoitc/gunicorn/commit/1e10a02e73c87dfadc394b361af33864d0e59e24","https://epadillas.github.io/2018/04/02/http-header-splitting-in-gunicorn-19.4.5","https://github.com/benoitc/gunicorn","https://github.com/pypa/advisory-database/tree/main/vulns/gunicorn/PYSEC-2018-55.yaml","https://lists.debian.org/debian-lts-announce/2018/04/msg00022.html","https://usn.ubuntu.com/4022-1","https://www.debian.org/security/2018/dsa-4186"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-32pc-xphx-q4f6","url":"https://osv.dev/vulnerability/GHSA-32pc-xphx-q4f6"}],"summary":"Gunicorn contains Improper Neutralization of CRLF sequences in HTTP headers"}