Update dependency gunicorn to v22 [SECURITY]#5

Open

renovate[bot] wants to merge 1 commit intomasterfrom

renovate/pypi-gunicorn-vulnerability

renovate bot commented Mar 1, 2026

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
gunicorn (changelog)	`==19.1.1` → `==22.0.0`

GitHub Vulnerability Alerts

CVE-2018-1000164

gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.

CVE-2024-1135

Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability has been shown to allow access to endpoints restricted by gunicorn. This issue has been addressed in version 22.0.0.

To be affected users must have a network path which does not filter out invalid requests. These users are advised to block access to restricted endpoints via a firewall or other mechanism if they are unable to update.

CVE-2024-6827

Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggling. This vulnerability can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, data integrity compromise, security bypass, information leakage, and business logic abuse.

Release Notes

benoitc/gunicorn (gunicorn)

`v22.0.0`: Gunicorn 22.0 has been released

Gunicorn 22.0.0 has been released. This version fix the numerous security vulnerabilities. You're invited to upgrade asap your own installation.

Changes:

22.0.0 - 2024-04-17
===================

- use `utime` to notify workers liveness
- migrate setup to pyproject.toml
- fix numerous security vulnerabilities in HTTP parser (closing some request smuggling vectors)
- parsing additional requests is no longer attempted past unsupported request framing
- on HTTP versions < 1.1 support for chunked transfer is refused (only used in exploits)
- requests conflicting configured or passed SCRIPT_NAME now produce a verbose error
- Trailer fields are no longer inspected for headers indicating secure scheme
- support Python 3.12

** Breaking changes **

- minimum version is Python 3.7
- the limitations on valid characters in the HTTP method have been bounded to Internet Standards
- requests specifying unsupported transfer coding (order) are refused by default (rare)
- HTTP methods are no longer casefolded by default (IANA method registry contains none affected)
- HTTP methods containing the number sign (#) are no longer accepted by default (rare)
- HTTP versions < 1.0 or >= 2.0 are no longer accepted by default (rare, only HTTP/1.1 is supported)
- HTTP versions consisting of multiple digits or containing a prefix/suffix are no longer accepted
- HTTP header field names Gunicorn cannot safely map to variables are silently dropped, as in other software
- HTTP headers with empty field name are refused by default (no legitimate use cases, used in exploits)
- requests with both Transfer-Encoding and Content-Length are refused by default (such a message might indicate an attempt to perform request smuggling)
- empty transfer codings are no longer permitted (reportedly seen with really old & broken proxies)

** SECURITY **

- fix CVE-2024-1135

Documentation is available there: https://docs.gunicorn.org/en/stable/news.html
Packages: https://pypi.org/project/gunicorn/

`v21.2.0`: Gunicorn 21.2.0 has been released

Gunicorn 21.2.0 has been released. This version fix the issue introduced in the threaded worker.

Changes:

21.2.0 - 2023-07-19
===================
fix thread worker: revert change considering connection as idle .

*** NOTE ***

This is fixing the bad file description error.

Documentation is available there: https://docs.gunicorn.org/en/stable/news.html
Packages: https://pypi.org/project/gunicorn/

`v21.1.0`: Gunicorn 21.1.0 has been released

gunicorn 21.1.0 has been released. This version fix the issue introduced in the threaded worker.

21.1.0 - 2023-07-18

fix thread worker: fix socket removal from the queuet checkout 21.x

`v21.0.1`: Gunicorn 21 has been released

Gunicorn 21 is out with miscellaneous changes. Enjoy!

We made this release major to start our new release cycle. More info will be provided on our discussion forum.

21.0.1 - 2023-07-17

fix documentation build

21.0.0 - 2023-07-17

support python 3.11
fix gevent and eventlet workers
fix threads support (gththread): improve performance and unblock requests
SSL: noaw use SSLContext object
HTTP parser: miscellaneous fixes
remove unecessary setuid calls
fix testing
improve logging
miscellaneous fixes to core engine

Full Changelog: benoitc/gunicorn@21.0.0...21.0.1

`v21.0.0`

`v20.1.0`

document WEB_CONCURRENCY is set by, at least, Heroku
capture peername from accept: Avoid calls to getpeername by capturing the peer name returned by
accept
log a warning when a worker was terminated due to a signal
fix tornado usage with latest versions of Django
add support for python -m gunicorn
fix systemd socket activation example
allows to set wsgi application in configg file using wsgi_app
document --timeout = 0
always close a connection when the number of requests exceeds the max requests
Disable keepalive during graceful shutdown
kill tasks in the gthread workers during upgrade
fix latency in gevent worker when accepting new requests
fix file watcher: handle errors when new worker reboot and ensure the list of files is kept
document the default name and path of the configuration file
document how variable impact configuration
document the $PORT environment variable
added milliseconds option to request_time in access_log
added PIP requirements to be used for example
remove version from the Server header
fix sendfile: use socket.sendfile instead of os.sendfile
reloader: use absolute path to prevent empty to prevent0 InotifyError when a file
is added to the working directory
Add --print-config option to print the resolved settings at startup.
remove the --log-dict-config CLI flag because it never had a working format
(the logconfig_dict setting in configuration files continues to work)

** Breaking changes **

minimum version is Python 3.5
remove version from the Server header

** Documentation **

** Others **

miscellaneous changes in the code base to be a better citizen with Python 3
remove dead code
fix documentation generation

`v20.0.4`

fix binding a socket using the file descriptor
remove support for the bdist_rpm build

`v20.0.3`

fixed load of a config file without a Python extension
fixed socketfromfd.fromfd when defaults are not set

note: we now warn when we load a config file without Python Extension

`v20.0.2`

20.0.2

fix changelog

20.0.1

fixed the way the config module is loaded. __file__ is now available
fixed wsgi.input_terminated. It is always true.
use the highest protocol version of openssl by default
only support Python >= 3.5
added __repr__ method to Config instance
fixed support of AIX platform and musl libc in socketfromfd.fromfd function
fixed support of applications loaded from a factory function
fixed chunked encoding support to prevent any request smuggling <https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn>_
Capture os.sendfile before patching in gevent and eventlet workers.
fix RecursionError.
removed locking in reloader when adding new files
load the WSGI application before the loader to pick up all files

note this release add official support for applications loaded from a factory function
as documented in Flask and other places.

`v20.0.1`

`v20.0.0`: 20.0

Fixed fdopen RuntimeWarning in Python 3.8
Added check and exception for str type on value in Response process_headers method.
Ensure WSGI header value is string before conducting regex search on it.
Added pypy3 to list of tested environments
Grouped StopIteration and KeyboardInterrupt exceptions with same body together in Arbiter.run()
Added setproctitle module to extras_require in setup.py
Avoid unnecessary chown of temporary files
Logging: Handle auth type case insensitively
Removed util.import_module
Removed fallback for types.SimpleNamespace in tests utils
Use SourceFileLoader instead instead of execfile_
Use importlib instead of __import__ and eval`
Fixed eventlet patching
Added optional datadog <https://www.datadoghq.com>_ tags for statsd metrics
Header values now are encoded using latin-1, not ascii.
Rewritten parse_address util added test
Removed redundant super() arguments
Simplify futures import in gthread module
Fixed worker_connections` setting to also affects the Gthread worker type
Fixed setting max_requests
Bump minimum Eventlet and Gevent versions to 0.24 and 1.4
Use Python default SSL cipher list by default
handle wsgi.input_terminated extension
Simplify Paste Deployment documentation
Fix root logging: root and logger are same level.
Fixed typo in ssl_version documentation
Documented systemd deployement unit examples
Added systemd sd_notify support
Fixed typo in gthread.py
Added tornado <https://www.tornadoweb.org/>_ 5 and 6 support
Declare our setuptools dependency
Added support to --bind to open file descriptors
Document how to serve WSGI app modules from Gunicorn
Provide guidance on X-Forwarded-For access log in documentation
Add support for named constants in the --ssl-version flag
Clarify log format usage of header & environment in documentation
Fixed systemd documentation to properly setup gunicorn unix socket
Prevent removal unix socket for reuse_port
Fix ResourceWarning when reading a Python config module
Remove unnecessary call to dict keys method
Support str and bytes for UNIX socket addresses
fixed InotifyReloadeder: handle module.__file__ is None
/dev/shm as a convenient alternative to making your own tmpfs mount in fchmod FAQ
fix examples to work on python3
Fix typo in --max-requests documentation
Clear tornado ioloop before os.fork
Miscellaneous fixes and improvement for linting using Pylint

`v19.10.0`

`v19.9.0`

fix: address a regression that prevented syslog support from working
(#1668, #1773)
fix: correctly set REMOTE_ADDR on versions of Python 3 affected by
Python Issue 30205 <https://bugs.python.org/issue30205>_
(#1755, #1796)
fix: show zero response length correctly in access log (#1787)
fix: prevent raising :exc:AttributeError when --reload is not passed
in case of a :exc:SyntaxError raised from the WSGI application.
(#1805, #1806)
❗️The internal module gunicorn.workers.async was renamed to
gunicorn.workers.base_async since async is now a reserved word
in Python 3.7.
(#1527)

`v19.8.1`

fix: secure scheme headers when bound to a unix socket (#1766, #1767)

`v19.8.0`

Eventlet 0.21.0 support (#1584)
Tornado 5 support (#1728, #1752)
support watching additional files with --reload-extra-file
(#1527)
support configuring logging with a dictionary with --logging-config-dict
(#1087, #1110, #1602)
add support for the --config flag in the GUNICORN_CMD_ARGS environment
variable (#1576, #1581)
disable SO_REUSEPORT by default and add the --reuse-port setting
(#1553, #1603, #1669)
fix: installing inotify on MacOS no longer breaks the reloader
(#1540, #1541)
fix: do not throw TypeError when SO_REUSEPORT is not available
(#1501, #1491)
fix: properly decode HTTP paths containing certain non-ASCII characters
(#1577, #1578)
fix: remove whitespace when logging header values under gevent (#1607)
fix: close unlinked temporary files (#1327, #1428)
fix: parse --umask=0 correctly (#1622, #1632)
fix: allow loading applications using relative file paths
(#1349, #1481)
fix: force blocking mode on the gevent sockets (#880, #1616)
fix: preserve leading / in request path (#1512, #1511)
fix: forbid contradictory secure scheme headers
fix: handle malformed basic authentication headers in access log
(#1683, #1684)
fix: defer handling of USR1 signal to a new greenlet under gevent
(#1645, #1651)
fix: the threaded worker would sometimes close the wrong keep-alive
connection under Python 2 (#1698, #1699)
fix: re-open log files on USR1 signal using handler._open to
support subclasses of FileHandler (#1739, #1742)
deprecation: the gaiohttp worker is deprecated, see the
worker-class documentation for more information
(#1338, #1418, #1569)

`v19.7.1`

== 19.7.1 ==

fix: continue if SO_REUSEPORT seems to be available but fails (#1480)
fix: support non-decimal values for the umask command line option (#1325)

`v19.7.0`

== 19.7.0 ==

The previously deprecated gunicorn_django command has been removed.
Use the command-line interface instead.
The previously deprecated django_settings setting has been removed.
Use the raw-env setting instead.
The default value of ssl-version has been changed from ssl.PROTOCOL_TLSv1 to ssl.PROTOCOL_SSLv23.
fix: initialize the group access list when initgroups is set (#1297)
add environment variables to gunicorn access log format (#1291)
add --paste-global-conf option (#1304)
fix: print access logs to STDOUT (#1184)
remove upper limit on max header size config (#1313)
fix: print original exception on AppImportError (#1334)
use SO_REUSEPORT if available (#1344)
fix leak of duplicate file descriptor for bound sockets.
add --reload-engine option, support inotify and other backends (#1368, #1459)
fix: reject request with invalid HTTP versions
add child_exit callback (#1394)
add support for eventlets _AlreadyHandled object (#1406)
format boot tracebacks properly with reloader (#1408)
refactor socket activation and fd inheritance for better support of SystemD (#1310)
fix: o fds are given by default in gunicorn (#1423)
add ability to pass settings to GUNICORN_CMD_ARGS environnement variable which helps in container world (#1385)
fix: catch access denied to pid file (#1091)
many additions and improvements to the documentation

Breaking Change

Python 2.6.0 is the last supported version

`v19.6.0`

== 19.6.0 ==

Core

improvement of the binary upgrade behaviour using USR2: remove file lockin (#1270)
add the --capture-output setting to capture stdout/stderr tot the log file (#1271)
Allow disabling sendfile() via the SENDFILE` environment variable (#1252)
fix reload under pycharm (#1129)

Workers

fix: make sure to remove the signal from the worker pipe (#1269)
fix: gthread worker, handle removed socket in the select loop (#1258)

`v19.5.0`

== 19.5.0 ==

=== Core ===

fix: Ensure response to HEAD request won't have message body
fix: lock domain socket and remove on last arbiter exit (#1220)
improvement: use EnvironmentError instead of socket.error (#939)
add: new $FORWARDDED_ALLOW_IPS environment variable (#1205)
fix: infinite recursion when destroying sockets (#1219)
fix: close sockets on shutdown (#922)
fix: clean up sys.exc_info calls to drop circular refs (#1228)
fix: do post_worker_init after load_wsgi (#1248)

=== Workers ===

fix access logging in gaiohttp worker (#1193)
eventlet: handle QUIT in a new coroutine (#1217)
gevent: remove obsolete exception clauses in run (#1218)
tornado: fix extra "Server" response header (#1246)
fix: unblock the wait loop under python 3.5 in sync worker (#1256)

=== Logging ===

fix: log message for listener reloading (#1181)
Let logging module handle traceback printing (#1201)
improvement: Allow configuring logger_class with statsd_host (#1188)
fix: traceback formatting (#1235)
fix: print error logs on stderr and access logs on stdout (#1184)

=== Documentation ===

Simplify installation instructions in gunicorn.org (#1072)
Fix URL and default worker type in example_config (#1209)
update django doc url to 1.8 lts (#1213)
fix: miscellaneous wording corrections (#1216)
Add PSF License Agreement of selectors.py to NOTICE (:issue: #1226)
document LOGGING overriding (#1051)
put a note that error logs are only errors from Gunicorn (#1124)
add a note about the requirements of the threads workers under python 2.x (#1200)
add access_log_format to config example (#1251)

=== Tests ===

Use more pytest.raises() in test_http.py

`v19.4.5`

== 19.4.5 ==

fix: NameError fileno in gunicorn.http.wsgi (#1178)

`v19.4.4`

== 19.4.4 ==

fix: check if a fileobject can be used with sendfile(2) (#1174)
doc: be more descriptive in errorlog option (#1173)

`v19.4.3`

== 19.4.3 ==

fix: don't check if a file is writable using os.stat with SELINUX (#1171)

`v19.4.2`

== 19.4.2 ==

=== Core ===

improvement: handle HaltServer in manage_workers (#1095)
fix: Do not rely on sendfile sending requested count (#1155)
fix: claridy --no-sendfile default (#1156)
fix: LoggingCatch sendfile failure from no file descriptor (#1160)

=== Logging ===

fix: Always send access log to syslog if syslog is on
fix: check auth before trying to own a file (#1157)

=== Documentation ===

fix: Fix Slowloris broken link. (#1142)
Tweak markup in faq.rst

=== Testing ===

fix: gaiohttp test (#1164)

`v19.4.1`

== 19.4.1 ==

fix tornado worker (#1154)

`v19.4.0`

`v19.3.0`

`v19.2.1`: Gunicorn 19.2.1 has been released

Gunicorn 19.2.1 is a patch release with fixes.

Changes:

Logging

expose loglevel in the Logger class

AsyncIO worker (gaiohttp)

fix #977 fix initial crash

Documentation

document security mailing-list in the contributing page.

Full changelog is available here:

benoitc/gunicorn@19.2...19.2.1

More

You can find the documentation here:

http://docs.gunicorn.org/en/19.2.1/

Latest version is also available on Pypi:

https://pypi.python.org/pypi/gunicorn/19.2.1

`v19.2.0`

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.


          Update dependency gunicorn to v22 [SECURITY]

131222a

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet