CVE-2012-2374
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- tornadoweb:tornado
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-f7fv-v9rh-prvc | PyPI | tornado | <2.2.1 | 2.2.1 |
| PYSEC-2012-5 | PyPI | tornado | <2.2.1 | 2.2.1 |