{"action":"Upgrade gunicorn to 22.0.0 or later.","affected":[{"fixed":"22.0.0","introduced":"0"}],"component":"gunicorn","cve_ids":["CVE-2024-1135"],"ecosystem":"PyPI","epss":0.02996,"exploited":false,"fixed_versions":["22.0.0"],"ghsa_id":"GHSA-w3h3-4rj7-4ph4","id":"tcs_01M5KGSK142DGVG4SAY5R10T53","modified_at":"2026-07-07T17:47:39.221645615Z","published_at":"2026-07-07T11:45:38.679382Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1434","https://nvd.nist.gov/vuln/detail/CVE-2024-1135","https://github.com/benoitc/gunicorn/issues/3091","https://github.com/benoitc/gunicorn/pull/3113","https://github.com/benoitc/gunicorn/commit/ac29c9b0a758d21f1e0fb3b3457239e523fa9f1d","https://github.com/benoitc/gunicorn","https://github.com/benoitc/gunicorn/releases/tag/22.0.0","https://huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1","https://lists.debian.org/debian-lts-announce/2024/06/msg00027.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00018.html","https://pypi.org/project/gunicorn","https://github.com/advisories/GHSA-w3h3-4rj7-4ph4"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"PYSEC-2026-1434","url":"https://osv.dev/vulnerability/PYSEC-2026-1434"}],"summary":"Request smuggling leading to endpoint restriction bypass in Gunicorn"}