CVE-2024-14029

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/tornadoweb/tornado/security/advisories/GHSA-753j-mpmx-qq6g
https://www.vulncheck.com/advisories/tornado-before-6.4.1-http-request-smuggling-via-transfer-encoding
https://github.com/tornadoweb/tornado/security/advisories/GHSA-753j-mpmx-qq6g

Configurations

No configuration.

History

28 Sep 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Tornado anterior a la versión 6.4.1 ignora los encabezados Transfer-Encoding: chunked duplicados, tratando las solicitudes como si no tuvieran cuerpo de mensaje y analizando el cuerpo chunked como una solicitud subsiguiente. Los atacantes pueden explotar esta inconsistencia cuando Tornado se despliega detrás de proxies para realizar contrabando de solicitudes HTTP, lo que permite la omisión del control de acceso, el envenenamiento de caché o la desincronización de la conexión.

Information

Published : 2026-09-15 16:17

Updated : 2026-09-28 14:10

NVD link : CVE-2024-14029

Mitre link : CVE-2024-14029

CVE.ORG link : CVE-2024-14029

JSON object : View

Products Affected

No product.

CWE

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

{"id": "CVE-2024-14029", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-14029", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-15T17:07:58.664131Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "tornadoweb", "product": "tornado", "versions": [{"status": "affected", "version": "0", "lessThan": "6.4.1", "versionType": "semver"}, {"status": "unaffected", "version": "6.4.1", "versionType": "semver"}], "packageURL": "pkg:pypi/tornado", "defaultStatus": "unaffected"}]}], "published": "2026-09-15T16:17:06.893", "references": [{"url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-753j-mpmx-qq6g", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/tornado-before-6.4.1-http-request-smuggling-via-transfer-encoding", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-753j-mpmx-qq6g", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization."}, {"lang": "es", "value": "Tornado anterior a la versi\u00f3n 6.4.1 ignora los encabezados Transfer-Encoding: chunked duplicados, tratando las solicitudes como si no tuvieran cuerpo de mensaje y analizando el cuerpo chunked como una solicitud subsiguiente. Los atacantes pueden explotar esta inconsistencia cuando Tornado se despliega detr\u00e1s de proxies para realizar contrabando de solicitudes HTTP, lo que permite la omisi\u00f3n del control de acceso, el envenenamiento de cach\u00e9 o la desincronizaci\u00f3n de la conexi\u00f3n."}], "lastModified": "2026-09-28T14:10:00.213", "sourceIdentifier": "disclosure@vulncheck.com"}