-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| meinheld | pip | < 1.0.2 | 1.0.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key issues in the HTTP parser: 1) The http_parser_execute function lacked checks for multiple Content-Length headers (CVE description and commit 0cfa70b's patch adding set_content_length flag). 2) Transfer-Encoding header handling had case-sensitive matching and allowed conflicts with Content-Length (commit 4155876's case correction and 3bc3e7c's conflict check). The patches explicitly add validation for these scenarios, confirming these were the vulnerable code paths.