Threats tagged 'brew-snakeviz-ghsa-753j-mpmx-qq6g'

CVE-2024-14029 is a critical HTTP request smuggling vulnerability in Tornado web server versions prior to 6.4.1. It occurs when Tornado receives HTTP requests containing two Transfer-Encoding: chunked headers, causing it to ignore both and misinterpret the request body. This behavior can lead to request smuggling attacks when Tornado is deployed behind proxies that forward such malformed requests, such as Pound. The vulnerability may allow attackers to bypass access controls, poison caches, or cause connection desynchronization.