Vulnerability	Vulnerable Version
H Race Condition Affected versions of this package are vulnerable to Race Condition when the fallback socketpair implementation is used on platforms that lack native support and the vulnerable function does not properly authenticate the connected sockets. An attacker must be able to predict the address and port and establish a connection before the legitimate client. How to fix Race Condition? Upgrade `gevent` to version 24.10.1 or higher.	[,24.10.1)
H Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Affected versions of this package are vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') when the `gevent.pywsgi` function is used. An attacker can craft invalid trailers in chunked requests on keep-alive connections that might appear as two requests to `gevent.pywsgi`. This could potentially bypass checks if an upstream server is filtering incoming requests based on paths or header fields and simply passing trailers through without validating them. Note: If the upstream server validated that the trailers meet the HTTP specification, this could not occur, because characters that are required in an HTTP request, like a space, are not allowed in trailers. How to fix Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')? Upgrade `gevent` to version 23.9.0 or higher.	[,23.9.0)

Race Condition

Affected versions of this package are vulnerable to Race Condition when the fallback socketpair implementation is used on platforms that lack native support and the vulnerable function does not properly authenticate the connected sockets. An attacker must be able to predict the address and port and establish a connection before the legitimate client.

How to fix Race Condition?

Upgrade gevent to version 24.10.1 or higher.

[,24.10.1)

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected versions of this package are vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') when the gevent.pywsgi function is used. An attacker can craft invalid trailers in chunked requests on keep-alive connections that might appear as two requests to gevent.pywsgi. This could potentially bypass checks if an upstream server is filtering incoming requests based on paths or header fields and simply passing trailers through without validating them.

Note: If the upstream server validated that the trailers meet the HTTP specification, this could not occur, because characters that are required in an HTTP request, like a space, are not allowed in trailers.

How to fix Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')?

Upgrade gevent to version 23.9.0 or higher.

[,23.9.0)

Go back to all versions of this package