CVE-2024-58384

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/tornadoweb/tornado/security/advisories/GHSA-w235-7p84-xx57
https://www.vulncheck.com/advisories/tornado-before-6.4.1-crlf-injection-via-curlasynchttpclient

Configurations

No configuration.

History

28 Sep 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Tornado anterior a la versión 6.4.1 contiene una vulnerabilidad de inyección CRLF en CurlAsyncHTTPClient que no rechaza los caracteres de retorno de carro y salto de línea en los encabezados de solicitud. Los atacantes pueden inyectar secuencias CRLF en los valores de los encabezados para inyectar encabezados arbitrarios o construir solicitudes HTTP completamente nuevas.

Information

Published : 2026-09-15 16:17

Updated : 2026-09-28 14:10

NVD link : CVE-2024-58384

Mitre link : CVE-2024-58384

CVE.ORG link : CVE-2024-58384

JSON object : View

Products Affected

No product.

CWE

CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

{"id": "CVE-2024-58384", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58384", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-17T19:16:19.322432Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "tornadoweb", "product": "tornado", "versions": [{"status": "affected", "version": "0", "lessThan": "6.4.1", "versionType": "semver"}, {"status": "unaffected", "version": "6.4.1", "versionType": "semver"}], "packageURL": "pkg:pypi/tornado", "defaultStatus": "unaffected"}]}], "published": "2026-09-15T16:17:07.053", "references": [{"url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-w235-7p84-xx57", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/tornado-before-6.4.1-crlf-injection-via-curlasynchttpclient", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-113"}]}], "descriptions": [{"lang": "en", "value": "Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests."}, {"lang": "es", "value": "Tornado anterior a la versi\u00f3n 6.4.1 contiene una vulnerabilidad de inyecci\u00f3n CRLF en CurlAsyncHTTPClient que no rechaza los caracteres de retorno de carro y salto de l\u00ednea en los encabezados de solicitud. Los atacantes pueden inyectar secuencias CRLF en los valores de los encabezados para inyectar encabezados arbitrarios o construir solicitudes HTTP completamente nuevas."}], "lastModified": "2026-09-28T14:10:00.213", "sourceIdentifier": "disclosure@vulncheck.com"}