CRITICAL 9.0 NVD
CVE-2024-14029
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequ
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.
References
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-753j-mpmx-qq6g
- https://www.vulncheck.com/advisories/tornado-before-6.4.1-http-request-smuggling-via-trans
This critical severity vulnerability with a CVSS score of 9.0 was published on 2026-09-15 via NVD.
Risk Timeline
CVE Disclosed2026-09-15 · -1 days ago
Remediation Resources
vulnfeed aggregates 13549 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.