CVE-2018-1000164

Name: CVE-2018-1000164
Creator: NVD / NIST
Published: 2018-04-18T19:29:00.707+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 2.43%

Last modified Jun 17, 2026

CVE-2018-1000164 is a vulnerability of currently unknown severity. gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.. EPSS estimates a 2.43% chance of exploitation in the next 30 days.

Description

gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.

Metrics

EPSS Probability

2.43%

82.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-93

Affected Software

Vendor	Product	Versions
Gunicorn	Gunicorn	19.4.5
Debian	Debian Linux	7.0
Debian	Debian Linux	8.0

References

https://epadillas.github.io/2018/04/02/http-header-splitting-in-gunicorn-19.4.5Exploit, Third Party Advisory
https://github.com/benoitc/gunicorn/issues/1227Exploit, Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/04/msg00022.htmlThird Party Advisory
https://usn.ubuntu.com/4022-1/
https://www.debian.org/security/2018/dsa-4186Third Party Advisory
https://epadillas.github.io/2018/04/02/http-header-splitting-in-gunicorn-19.4.5Exploit, Third Party Advisory
https://github.com/benoitc/gunicorn/issues/1227Exploit, Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/04/msg00022.htmlThird Party Advisory
https://usn.ubuntu.com/4022-1/
https://www.debian.org/security/2018/dsa-4186Third Party Advisory

Timeline

Published: Apr 18, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-1000164?

How severe is CVE-2018-1000164?

Severity scoring for CVE-2018-1000164 is pending analysis. The EPSS model estimates a 2.43% probability of exploitation in the next 30 days.

How do I fix CVE-2018-1000164?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-1000164?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST