CVSS 4.0
9.0 criticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:NCVE-2024-14029
Critical (9.0). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in tornado 6.4.1.
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.
Severity
CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
- CWE
- CWE-444
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-753j-mpmx-qq6g | PyPI | tornado | <6.4.1 | 6.4.1 |