This is only partially true. The attack exploits a desync between your application and the proxy, so you can vulnerable to this attack even if you are behind a

This is only partially true. The attack exploits a desync between your application and the proxy, so you can vulnerable to this attack even if you are behind a proxy that respects the HTTP spec if your application doesn't. I actually wrote a medium article about this since I fixed the vulnerability in gunicorn [1] a while ago, but I didn't release it (I will and repost here). What you linked to for the AWS ALB is only fixing ONE way to create a desync between the proxy and the server. EDIT: Here is the link to my blog post https://medium.com/@emilefugulin/http-desync-attacks-with-python-and-aws-1ba07d2c860f https://medium.com/@emilefugulin/http-desync-attacks-with-py... [1] https://github.com/benoitc/gunicorn/pull/2181 https://github.com/benoitc/gunicorn/pull/2181