Read the docs
TI-2012-02103 Aliases CVE-2012-2374GHSA-f7fv-v9rh-prvc

CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in…

Priority LOW 26CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.

Summary

CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.

Why it matters now

EPSS 0.01346 71st percentileScored 2026-11-07
Fix Fixed tornado (PyPI): 2.2.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—tornado (PyPI)before 2.2.12.2.1Patch availableGHSA-f7fv-v9rh-prvc
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • tornado (PyPI) Vendor— Affected before 2.2.1 Fixed in 2.2.1 Patch available GHSA-f7fv-v9rh-prvc

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*up to 2.2Vulnerabletornadoweb
cpe:2.3:a:tornadoweb:tornado:1.0:*:*:*:*:*:*:*1.0Vulnerabletornadoweb
cpe:2.3:a:tornadoweb:tornado:1.0.1:*:*:*:*:*:*:*1.0.1Vulnerabletornadoweb
cpe:2.3:a:tornadoweb:tornado:1.1:*:*:*:*:*:*:*1.1Vulnerabletornadoweb
cpe:2.3:a:tornadoweb:tornado:1.1.1:*:*:*:*:*:*:*1.1.1Vulnerabletornadoweb
cpe:2.3:a:tornadoweb:tornado:1.2:*:*:*:*:*:*:*1.2Vulnerabletornadoweb
cpe:2.3:a:tornadoweb:tornado:1.2.1:*:*:*:*:*:*:*1.2.1Vulnerabletornadoweb
cpe:2.3:a:tornadoweb:tornado:2.0:*:*:*:*:*:*:*2.0Vulnerabletornadoweb
cpe:2.3:a:tornadoweb:tornado:2.1:*:*:*:*:*:*:*2.1Vulnerabletornadoweb
cpe:2.3:a:tornadoweb:tornado:2.1.1:*:*:*:*:*:*:*2.1.1Vulnerabletornadoweb
  • cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:* Versions up to 2.2 Vulnerable ·tornadoweb
  • cpe:2.3:a:tornadoweb:tornado:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·tornadoweb
  • cpe:2.3:a:tornadoweb:tornado:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·tornadoweb
  • cpe:2.3:a:tornadoweb:tornado:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·tornadoweb
  • cpe:2.3:a:tornadoweb:tornado:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·tornadoweb
  • cpe:2.3:a:tornadoweb:tornado:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·tornadoweb
  • cpe:2.3:a:tornadoweb:tornado:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·tornadoweb
  • cpe:2.3:a:tornadoweb:tornado:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·tornadoweb
  • cpe:2.3:a:tornadoweb:tornado:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·tornadoweb
  • cpe:2.3:a:tornadoweb:tornado:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·tornadoweb

Remediation

  • Fix · GHSA-f7fv-v9rh-prvc tornado (PyPI) Fixed in 2.2.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-2374
  2. 2026-10-03 Alias added: GHSA-f7fv-v9rh-prvc

References

Advisory 2

Other 7

  • TI-2026-24502 Tornado has a DoS due to too many multipart parts CVSS 4.0HIGH 8.7
  • TI-2024-35317 Tornado has HTTP cookie parsing DoS vulnerability CVSS 3.1HIGH 7.5
  • TI-2025-41422 Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters CVSS 3.1HIGH 7.5
  • TI-2025-41421 Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing CVSS 3.1HIGH 7.5
  • TI-2025-29817 Tornado vulnerable to excessive logging caused by malformed multipart form data CVSS 3.1HIGH 7.5
  • TI-2026-27646 In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path… CVSS 3.1HIGH 7.2
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences