Vulnerability Description
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-753j-mpmx-qq6g
- https://www.vulncheck.com/advisories/tornado-before-6.4.1-http-request-smuggling
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-753j-mpmx-qq6g
FAQ
What is CVE-2024-14029?
CVE-2024-14029 is a vulnerability with a CVSS score of 7.5 (HIGH). Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this ...
How severe is CVE-2024-14029?
CVE-2024-14029 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-14029?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.