Cherokee webserver versions less than 0.5.1 allows for XSS in its 400 error message.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/45396/cherokee-0.5.0.txt
Source: https://packetstormsecurity.com/files/45396/cherokee-0.5.0.txt.html