Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck

CVE-2024-14029Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

High 7.5

In plain English

A high-severity security flaw in tornado from tornadoweb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 69.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8pcs0.10.18-2.el8_10.10.alma.1ALSA-2026:84798
AlmaLinux:8pcs-snmp0.10.18-2.el8_10.10.alma.1ALSA-2026:84798
Debian:12python-tornadono fix listedDEBIAN-CVE-2024-14029
Debian:13python-tornado6.4.1-1DEBIAN-CVE-2024-14029
Debian:14python-tornado6.4.1-1DEBIAN-CVE-2024-14029
PyPItornado6.4.1GHSA-753j-mpmx-qq6g
Rocky Linux:8pcs0:0.10.18-2.el8_10.10RLSA-2026:84798
Ubuntu:24.04:LTSpython-tornado6.4.0-1ubuntu0.6UBUNTU-CVE-2024-14029
Ubuntu:24.04:LTSpython-tornado6.4.0-1ubuntu0.6USN-8952-1
Ubuntu:26.04:LTSpython-tornado6.5.4-0.1ubuntu0.2USN-8952-1
Ubuntu:26.10python-tornado6.5.5-5ubuntu1.1USN-8952-1

Affected products (as reported)

VendorProductVersions
tornadoweb tornado 0 – before 6.4.1

Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

References