CVE-2024-14029
published 2026-09-15CVE-2024-14029: Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a…
PriorityP347high7.5CVSS 3.1
AVNACHPRNUINSCCLIHAN
EPSS
0.36%
28.7th percentile
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-tornado | — | — |
| tornadoweb | tornado | < 6.4.1 | 6.4.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
nvdv4.09.0CRITICALCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
TornadoWeb Tornado up to 6.4.0 request smuggling (Nessus ID 367287)
vuldb·2026-10-19·CVSS 7.5
CVE-2024-14029 [HIGH] TornadoWeb Tornado up to 6.4.0 request smuggling (Nessus ID 367287)
A vulnerability was found in TornadoWeb Tornado up to 6.4.0 and classified as problematic. Impacted is an unknown function. The manipulation results in http request smuggling.
This vulnerability is known as CVE-2024-14029. It is possible to launch the attack remotely. No exploit is available.
It is suggested to upgrade the affected component.
GHSA
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request.
ghsa_unreviewed·2026-09-15
CVE-2024-14029 [CRITICAL] CWE-444 Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request.
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.
Red Hat
python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
vendor_redhat·2026-09-15·CVSS 7.5
CVE-2024-14029 [HIGH] CWE-444 python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.
A vulnerability was discovered in Tornado where it improperly handles HTTP requests containing duplicate Transfer-Encoding: chunked headers. When duplicate Transfer-Encoding headers are present in an incoming request, Tornado ignores them and treats the request as body-less, leaving the chunked message body unparsed in the HTTP socket stream.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2024-14029 python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding [epel-all]
bugzilla·2026-09-28·CVSS 7.5
CVE-2024-14029 [HIGH] CVE-2024-14029 python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding [epel-all]
CVE-2024-14029 python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.
Bugzilla
CVE-2024-14029 python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
bugzilla·2026-09-15·CVSS 7.5
CVE-2024-14029 [HIGH] CVE-2024-14029 python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
CVE-2024-14029 python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.
2026-09-15
Published