CVE-2023-54397
published 2026-09-15CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters…
PriorityP348high7.5CVSS 3.1
AVNACHPRNUINSCCLIHAN
EPSS
0.38%
30.5th percentile
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-tornado | — | — |
| tornadoweb | tornado | < 6.3.3 | 6.3.3 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
nvdv4.09.0CRITICALCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters.
ghsa_unreviewed·2026-09-15
CVE-2023-54397 [CRITICAL] CWE-444 Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters.
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.
Red Hat
python-tornado: Tornado before 6.3.3 HTTP Request Smuggling via Content-Length
vendor_redhat·2026-09-15·CVSS 7.5
CVE-2023-54397 [HIGH] CWE-444 python-tornado: Tornado before 6.3.3 HTTP Request Smuggling via Content-Length
python-tornado: Tornado before 6.3.3 HTTP Request Smuggling via Content-Length
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.
A flaw was found in Tornado's HTTP request header parsing logic. When processing incoming HTTP requests, Tornado fails to reject malformed Content-Length headers containing non-standard characters. An unauthenticated remote attacker can exploit this parsing discrepancy when Tornado is deployed behind a front-end proxy or load balancer to cause a request boundary mismatch. This allows the attacker to conduct HTTP
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2023-54397 python-tornado: Tornado before 6.3.3 HTTP Request Smuggling via Content-Length [epel-all]
bugzilla·2026-09-28·CVSS 7.5
CVE-2023-54397 [HIGH] CVE-2023-54397 python-tornado: Tornado before 6.3.3 HTTP Request Smuggling via Content-Length [epel-all]
CVE-2023-54397 python-tornado: Tornado before 6.3.3 HTTP Request Smuggling via Content-Length [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.
Bugzilla
CVE-2023-54397 python-tornado: Tornado before 6.3.3 HTTP Request Smuggling via Content-Length
bugzilla·2026-09-15·CVSS 7.5
CVE-2023-54397 [HIGH] CVE-2023-54397 python-tornado: Tornado before 6.3.3 HTTP Request Smuggling via Content-Length
CVE-2023-54397 python-tornado: Tornado before 6.3.3 HTTP Request Smuggling via Content-Length
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.
2026-09-15
Published