https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-6827.htmlhttps://patchthecve.com/cve/CVE-2024-6827.htmlWed, 17 Jun 2026 08:18:47 +0000HIGH 7.5: Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data expohttps://patchthecve.com/cve/CVE-2024-7923.htmlhttps://patchthecve.com/cve/CVE-2024-7923.htmlWed, 17 Jun 2026 08:21:12 +0000CRITICAL 9.8: An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowihttps://patchthecve.com/cve/CVE-2024-1135.htmlhttps://patchthecve.com/cve/CVE-2024-1135.htmlWed, 17 Jun 2026 07:03:32 +0000HIGH 7.5: Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handlinhttps://patchthecve.com/cve/CVE-2022-23470.htmlhttps://patchthecve.com/cve/CVE-2022-23470.htmlWed, 17 Jun 2026 04:30:11 +0000HIGH 8.6: Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gunicorn, which can be used to read any file accessible to the operating system user under which Galaxy is running. This vulnerability affects Galaxy 22.01 and highttps://patchthecve.com/cve/CVE-2022-42902.htmlhttps://patchthecve.com/cve/CVE-2022-42902.htmlWed, 17 Jun 2026 05:05:33 +0000HIGH 8.8: In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improper input sanitization, an anonymous user can force the lava-server-gunicorn service to execute user-provided code on the server.