Skip to main content

CVE-2024-14029: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornadoweb tornado

0
Critical
VulnerabilityCVE-2024-14029cvecve-2024-14029
Published: 09/15/2026 (09/15/2026, 15:17:52 UTC)
Source: CVE Database V5
Vendor/Project: tornadoweb
Product: tornado

Description

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.

CVSS v4.0

Score 9.0critical

Attack Vector
Network
Attack Complexity
High
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vuln. Confidentiality
Low
Vuln. Integrity
High
Vuln. Availability
None
Subsq. Confidentiality
Low
Subsq. Integrity
High
Subsq. Availability
None
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N

Affected software

tornadoweb

tornado

Affected versions
>=0 <6.4.1
tornado
pkg:pypi/tornado
Affected versions
>=0 <6.4.1

Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 09/15/2026, 16:16:42 UTC

Technical Analysis

Tornado versions prior to 6.4.1 improperly handle HTTP requests containing duplicate Transfer-Encoding: chunked headers by ignoring the duplicates and treating the request as having no message body. This causes the chunked body to be parsed as a subsequent request, creating an inconsistency exploitable in HTTP request smuggling attacks. Such attacks can be leveraged to bypass access controls, poison caches, or desynchronize connections when Tornado is deployed behind proxy servers.

Potential Impact

Successful exploitation can allow attackers to bypass access controls, poison caches, or cause connection desynchronization, which may lead to unauthorized access or manipulation of HTTP traffic. The vulnerability has a critical severity with a CVSS 4.0 score of 9, indicating a high potential impact on confidentiality, integrity, and availability.

Mitigation Recommendations

Upgrade Tornado to version 6.4.1 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed fixed in Tornado 6.4.1.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Data Version
5.2
Assigner Short Name
VulnCheck
Date Reserved
2026-03-23T19:30:06.622Z
Cvss Version
4.0
State
PUBLISHED

Threat ID: 6aa9651455bf5e2cf502e8eb

Added to database: 09/15/2026, 15:32:36 UTC

Last enriched: 09/15/2026, 16:16:42 UTC

Last updated: 09/15/2026, 23:58:41 UTC

Views: 7

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses