[Triage] uWSGI protocol corrupts responses without Content-Length

[methane]

Type

Bug Report

Description

Note

Regarding AI usage:
After I found this bug, I instructed Codex to reproduce it and create the following issue report.

When Gunicorn is run with --protocol uwsgi behind nginx's uwsgi_pass, a WSGI response without a Content-Length header is corrupted.

Gunicorn applies HTTP/1.1 chunked transfer encoding to the response sent over the uWSGI connection. nginx treats those chunk markers as opaque upstream response-body bytes and then applies its own chunked encoding for the downstream HTTP response.

Consequently, after curl decodes nginx's outer chunked encoding, Gunicorn's inner chunk markers remain in the response body.

I reproduced this with:

Gunicorn 26.0.0
Gunicorn master at 3110e8c (version 26.1.0)
nginx 1.28.0
Python 3.12.13
curl 8.5.0
Ubuntu 24.04

Steps to Reproduce (for bugs)

Create app.py:

def app(environ, start_response):
    body = b"Hello, world!\n"
    start_response("200 OK", [("Content-Type", "text/plain")])
    return [body]

Create nginx.conf:

worker_processes 1;
error_log stderr;
pid nginx.pid;

events {
    worker_connections 128;
}

http {
    access_log off;

    server {
        listen 127.0.0.1:8080;

        location / {
            include /etc/nginx/uwsgi_params;
            uwsgi_pass 127.0.0.1:8000;
        }
    }
}

Create a directory for nginx's runtime files:

$ mkdir nginx-run

Start Gunicorn:

$ gunicorn \
    --bind 127.0.0.1:8000 \
    --workers 1 \
    --protocol uwsgi \
    app:app

Start nginx in another terminal:

$ nginx \
    -p "$PWD/nginx-run/" \
    -c "$PWD/nginx.conf" \
    -g 'daemon off;'

Then request the application:

$ curl --http1.1 --include http://127.0.0.1:8080/
HTTP/1.1 200 OK
Content-Type: text/plain
Transfer-Encoding: chunked
Connection: keep-alive
Server: gunicorn
...

E
Hello, world!

0

The response body returned by curl is effectively:

b"E\r\nHello, world!\n\r\n0\r\n\r\n"

The E and 0 are Gunicorn's inner HTTP chunk framing and should not be part of the application response.

Using --raw shows both framing layers:

$ curl --silent --http1.1 --include --raw http://127.0.0.1:8080/
HTTP/1.1 200 OK
Content-Type: text/plain
Transfer-Encoding: chunked
...

18
E
Hello, world!

0


0

Here, 18 and the final 0 are nginx's outer chunk framing. The payload of that outer chunk contains Gunicorn's E ... 0 chunk stream.

Configuration

No response

Logs / Error Output

No response

Gunicorn Version

Gunicorn 26.0.0

Python Version

Python 3.12.13

Worker Class

sync (default)

Operating System

Ubuntu 24.04

Additional Context

Analysis

UWSGIRequest.version is currently hard-coded to (1, 1):

gunicorn/gunicorn/uwsgi/message.py

Lines 38 to 45 in 3110e8c

	# Request attributes (compatible with HTTP Request interface)
	self.method = None
	self.uri = None
	self.path = None
	self.query = None
	self.fragment = ""
	self.version = (1, 1) # uWSGI is HTTP/1.1 compatible
	self.headers = []

The generic WSGI Response.is_chunked() therefore enables chunking whenever the application does not provide Content-Length:

gunicorn/gunicorn/http/wsgi.py

Lines 401 to 412 in 3110e8c

	def is_chunked(self):
	# Only use chunked responses when the client is
	# speaking HTTP/1.1 or newer and there was
	# no Content-Length header set.
	if self.response_length is not None:
	return False
	elif self.req.version <= (1, 0):
	return False
	elif self._omits_body:
	# No body permitted (HEAD or 1xx/204/304), so no chunked framing.
	return False
	return True

Response.default_headers() emits Transfer-Encoding: chunked, and Response.write() passes self.chunked to util.write(), which adds the chunk markers:

gunicorn/gunicorn/http/wsgi.py

Lines 414 to 474 in 3110e8c

	def default_headers(self):
	# set the connection header
	if self.upgrade:
	connection = "upgrade"
	elif self.should_close():
	connection = "close"
	else:
	connection = "keep-alive"
	headers = [
	"HTTP/%s.%s %s\r\n" % (self.req.version[0],
	self.req.version[1], self.status),
	"Server: %s\r\n" % self.version,
	"Date: %s\r\n" % util.http_date(),
	"Connection: %s\r\n" % connection
	]
	if self.chunked:
	headers.append("Transfer-Encoding: chunked\r\n")
	return headers
	def send_headers(self):
	if self.headers_sent:
	return
	tosend = self.default_headers()
	tosend.extend(["%s: %s\r\n" % (k, v) for k, v in self.headers])
	header_str = "%s\r\n" % "".join(tosend)
	util.write(self.sock, util.to_bytestring(header_str, "latin-1"))
	self.headers_sent = True
	def write(self, arg):
	self.send_headers()
	if not isinstance(arg, bytes):
	raise TypeError('%r is not a byte' % arg)
	if self._omits_body:
	if arg and not self._omits_body_warned:
	log.warning(
	"WSGI app sent body bytes on a no-body response "
	"(method=%s status=%s); dropping per RFC 9110.",
	self.req.method, self.status_code,
	)
	self._omits_body_warned = True
	return
	arglen = len(arg)
	tosend = arglen
	if self.response_length is not None:
	if self.sent >= self.response_length:
	# Never write more than self.response_length bytes
	return
	tosend = min(self.response_length - self.sent, tosend)
	if tosend < arglen:
	arg = arg[:tosend]
	# Sending an empty chunk signals the end of the
	# response and prematurely closes the response
	if self.chunked and tosend == 0:
	return
	self.sent += tosend
	util.write(self.sock, arg, self.chunked)

The terminal chunk is also written by Response.close():

gunicorn/gunicorn/http/wsgi.py

Lines 530 to 534 in 3110e8c

	def close(self):
	if not self.headers_sent:
	self.send_headers()
	if self.chunked:
	util.write_chunk(self.sock, b"")

HTTP chunk framing should not be used for the response body sent over the uWSGI upstream connection. Gunicorn should send the unframed response body and let nginx choose the downstream HTTP framing. When no Content-Length is available, the upstream connection may also need to be closed to delimit the uWSGI response.

Existing integration-test gap

The existing nginx/uWSGI integration-test application already has a response without Content-Length:

gunicorn/tests/docker/uwsgi/app.py

Lines 41 to 46 in 3110e8c

	def handle_root(environ, start_response):
	"""Basic root endpoint."""
	status = '200 OK'
	headers = [('Content-Type', 'text/plain')]
	start_response(status, headers)
	return [b'Hello from gunicorn uWSGI!\n']

However, its test only checks that the expected text occurs somewhere in the response:

gunicorn/tests/docker/uwsgi/test_uwsgi_integration.py

Lines 25 to 29 in 3110e8c

	def test_get_root(self, nginx_url):
	"""Test basic GET request to root endpoint."""
	response = requests.get(f'{nginx_url}/')
	assert response.status_code == 200
	assert b'Hello from gunicorn uWSGI!' in response.content

The corrupted body still contains that substring, so the test passes. An exact assertion would expose the problem:

assert response.content == b"Hello from gunicorn uWSGI!\n"

Checklist

• I have searched existing discussions and issues for duplicates
• I have checked the documentation and FAQ