VDB
CVE-2024-14029
CVE-2024-14029
PUBLISHED
CVSS 9 CRITICAL
Reported by VulnCheck · Published September 15, 2026
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.
Risk Scores
CVSS 4.0
9
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| tornadoweb | tornado | 0, 6.4.1 |
| tornadoweb | tornado | 0, 6.4.1 |
Timeline
- Sep 15, 2026 Coalition ESS Score
- Sep 15, 2026 CVE Published
- Sep 15, 2026 CVE Updated
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
- Sep 26, 2026 EPSS Score
- Sep 30, 2026 EPSS Score
- Oct 2, 2026 EPSS Score
- Oct 6, 2026 EPSS Score
- Oct 8, 2026 EPSS Score
- Oct 11, 2026 EPSS Score
References
- GitHub Security Advisory (GHSA-753j-mpmx-qq6g) vendor-advisory
- VulnCheck Advisory: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding third-party-advisory