Skip to content
CVE PROGRAM SOURCE RECORD9.0 Critical

CVE-2023-54397

Tornado before 6.3.3 HTTP Request Smuggling via Content-Length

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

tornadoweb tornado

Default version status: unaffected

  • 0 to < 6.3.3affected
  • 6.3.3unaffected
pkg:pypi/tornado

References