CVE-2023-54397 — Tornado before 6.3.3 HTTP Request Smuggling via Content-Length

Affected: tornadoweb tornado

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.

USN-8952-1 — python-tornado vulnerabilities

Affected: Ubuntu:Pro:16.04:LTS: python-tornado, Ubuntu:Pro:18.04:LTS: python-tornado, Ubuntu:Pro:20.04:LTS: python-tornado, Ubuntu:Pro:22.04:LTS: python-tornado, Ubuntu:24.04:LTS: python-tornado, Ubuntu:26.10: python-tornado, Ubuntu:26.04:LTS: python-tornado

It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls.

(CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262, CVE-2026-103263)

Most recent entries from all

CVE-2023-54397 — Tornado before 6.3.3 HTTP Request Smuggling via Content-Length

USN-8952-1 — python-tornado vulnerabilities