CVE-2024-58384

6.3 mediumEPSS 0.2%

Medium (6.3). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in tornado 6.4.1.

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.

Severity

CVSS 4.0

6.3 medium

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
CWE: CWE-113
Published: 2026-09-15
Modified: 2026-09-28
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-w235-7p84-xx57	PyPI	tornado	<6.4.1	6.4.1

References

https://github.com/tornadoweb/tornado/security/advisories/GHSA-w235-7p84-xx57
https://www.vulncheck.com/advisories/tornado-before-6.4.1-crlf-injection-via-curlasynchttpclient

Check your stack JSON