CVE-2024-58384
published 2026-09-15CVE-2024-58384: Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request…
PriorityP430medium5.4CVSS 3.1
AVNACHPRNUINSCCLILAN
EPSS
0.25%
15.3th percentile
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.
Affected
65 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| clusterlabs | pcs | — | — |
| debian | python-tornado | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| mta | mta-solution-server-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| rhel10 | keylime-registrar | — | — |
| rhel10 | keylime-verifier | — | — |
| rhel9 | keylime-registrar | — | — |
| rhel9 | keylime-verifier | — | — |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhelai3 | bootc-rocm-rhel9 | — | — |
| rhelai3 | disk-image-cuda-rhel9 | — | — |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-llama-stack-core-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers.
ghsa_unreviewed·2026-09-15
CVE-2024-58384 [MEDIUM] CWE-113 Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers.
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.
Red Hat
tornado: Tornado: CRLF injection in CurlAsyncHTTPClient allows arbitrary header injection or new HTTP requests.
vendor_redhat·2026-09-15·CVSS 5.4
CVE-2024-58384 [MEDIUM] CWE-93 tornado: Tornado: CRLF injection in CurlAsyncHTTPClient allows arbitrary header injection or new HTTP requests.
tornado: Tornado: CRLF injection in CurlAsyncHTTPClient allows arbitrary header injection or new HTTP requests.
A flaw was found in Tornado's `CurlAsyncHTTPClient` component. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the client fails to properly reject carriage return and line feed characters in HTTP request headers. A remote attacker can exploit this by injecting these characters into header values, allowing them to inject arbitrary headers or construct entirely new HTTP requests. This could potentially lead to server-side request forgery (SSRF) vulnerabilities.
Package: exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 (Exploit Intelligence) - Out of support scope
Package: lightspeed-core/lightspeed-stack-rhel9 (Lightspeed Cor
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2024-58384 python-flit: Tornado: CRLF injection in CurlAsyncHTTPClient allows arbitrary header injection or new HTTP requests. [epel-all]
bugzilla·2026-09-24·CVSS 5.4
CVE-2024-58384 [MEDIUM] CVE-2024-58384 python-flit: Tornado: CRLF injection in CurlAsyncHTTPClient allows arbitrary header injection or new HTTP requests. [epel-all]
CVE-2024-58384 python-flit: Tornado: CRLF injection in CurlAsyncHTTPClient allows arbitrary header injection or new HTTP requests. [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.
Discussion:
Reassigning from `epel10` to `epel9`: Bug filed against a branch the package never shipped on.
Bugzilla
CVE-2024-58384 python-pep517: Tornado: CRLF injection in CurlAsyncHTTPClient allows arbitrary header injection or new HTTP requests. [epel-all]
bugzilla·2026-09-24·CVSS 5.4
CVE-2024-58384 [MEDIUM] CVE-2024-58384 python-pep517: Tornado: CRLF injection in CurlAsyncHTTPClient allows arbitrary header injection or new HTTP requests. [epel-all]
CVE-2024-58384 python-pep517: Tornado: CRLF injection in CurlAsyncHTTPClient allows arbitrary header injection or new HTTP requests. [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.
Bugzilla
CVE-2024-58384 python-flit: Tornado: CRLF injection in CurlAsyncHTTPClient allows arbitrary header injection or new HTTP requests. [fedora-all]
bugzilla·2026-09-24·CVSS 5.4
CVE-2024-58384 [MEDIUM] CVE-2024-58384 python-flit: Tornado: CRLF injection in CurlAsyncHTTPClient allows arbitrary header injection or new HTTP requests. [fedora-all]
CVE-2024-58384 python-flit: Tornado: CRLF injection in CurlAsyncHTTPClient allows arbitrary header injection or new HTTP requests. [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.
Bugzilla
CVE-2024-58384 tornado: Tornado: CRLF injection in CurlAsyncHTTPClient allows arbitrary header injection or new HTTP requests.
bugzilla·2026-09-15·CVSS 5.4
CVE-2024-58384 [MEDIUM] CVE-2024-58384 tornado: Tornado: CRLF injection in CurlAsyncHTTPClient allows arbitrary header injection or new HTTP requests.
CVE-2024-58384 tornado: Tornado: CRLF injection in CurlAsyncHTTPClient allows arbitrary header injection or new HTTP requests.
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.
2026-09-15
Published