Read the docs
TI-2024-13023 Aliases CVE-2024-14029GHSA-hr42-gv84-2f3g

Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

Priority HIGH 72CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · High · None
Fix status
Partial Red Hat: 17 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00361 30th percentileScored 2026-11-07
Fix Partial tornado (tornadoweb): 6.4.1Red Hat: 11 advisoriesRed Hat: 17 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tornadowebtornadobefore 6.4.16.4.1Patch availableCNA
  • tornado Vendortornadoweb Affected before 6.4.1 Fixed in 6.4.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*——tornadoweb
  • cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:* Versions — — ·tornadoweb

Remediation

  • Fix · CNA tornado (tornadoweb) Fixed in 6.4.1

Red Hat 11 advisories

  • RHSA-2026:86891 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 3.5.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
  • RHSA-2026:85135 Released 2026-10-19 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS EXTENSION (v.8.6) pcs-0.10.12-6.el8_6.14, pcs-snmp-0.10.12-6.el8_6.14
  • RHSA-2026:84844 Released 2026-10-19 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.8) pcs-0.10.15-4.el8_8.12, pcs-snmp-0.10.15-4.el8_8.12
    • Red Hat Enterprise Linux High Availability TUS (v.8.8) pcs-0.10.15-4.el8_8.12, pcs-snmp-0.10.15-4.el8_8.12
Show 8 more Red Hat advisories
  • RHSA-2026:84843 Released 2026-10-19 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) pcs-0.10.8-1.el8_4.12, pcs-snmp-0.10.8-1.el8_4.12
    • Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) pcs-0.10.8-1.el8_4.12, pcs-snmp-0.10.8-1.el8_4.12
  • RHSA-2026:84798 Released 2026-10-19 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux HighAvailability (v. 8) pcs-0.10.18-2.el8_10.10, pcs-snmp-0.10.18-2.el8_10.10
    • Red Hat Enterprise Linux ResilientStorage (v. 8) pcs-0.10.18-2.el8_10.10, pcs-snmp-0.10.18-2.el8_10.10
  • RHSA-2025:3108 Released 2025-03-24 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v.9.2) pcs-0.11.4-7.el9_2.4, pcs-snmp-0.11.4-7.el9_2.4
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.2) pcs-0.11.4-7.el9_2.4, pcs-snmp-0.11.4-7.el9_2.4
  • RHSA-2025:2470 Released 2025-03-10 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v.9.4) pcs-0.11.7-2.el9_4.3, pcs-snmp-0.11.7-2.el9_4.3
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) pcs-0.11.7-2.el9_4.3, pcs-snmp-0.11.7-2.el9_4.3
  • RHSA-2025:2471 Released 2025-03-10 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 9) pcs-0.11.8-1.el9_5.2, pcs-snmp-0.11.8-1.el9_5.2
    • Red Hat Enterprise Linux Resilient Storage (v. 9) pcs-0.11.8-1.el9_5.2, pcs-snmp-0.11.8-1.el9_5.2
  • RHSA-2024:10843 Released 2024-12-05 · Red Hat rating Important
    python-tornado security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) python-tornado-6.4.2-1.el9_4, python3-tornado-6.4.2-1.el9_4
  • RHSA-2024:10836 Released 2024-12-05 · Red Hat rating Important
    python-tornado security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) python-tornado-6.4.2-1.el9_2, python3-tornado-6.4.2-1.el9_2
  • RHSA-2024:10590 Released 2024-12-02 · Red Hat rating Important
    python-tornado security update
    • Red Hat Enterprise Linux AppStream (v. 9) python-tornado-6.4.2-1.el9_5, python3-tornado-6.4.2-1.el9_5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    tornadoweb tornado 6.4.1

    2 records Highest priority Priority HIGH 1 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2024-38463 Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClientPriority LOW 28
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat OpenStack Platform 16.2AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:10590
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:10836
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2024:10843
Red Hat Enterprise Linux High Availability (v. 9)Fixed RHSA-2025:2471
Red Hat Enterprise Linux High Availability AUS (v.8.4)Fixed RHSA-2026:84843
Red Hat Enterprise Linux High Availability E4S (v.8.8)Fixed RHSA-2026:84844
Red Hat Enterprise Linux High Availability EUS (v.9.2)Fixed RHSA-2025:3108
Red Hat Enterprise Linux High Availability EUS (v.9.4)Fixed RHSA-2025:2470
Red Hat Enterprise Linux High Availability EUS EXTENSION (v.8.6)Fixed RHSA-2026:85135
Red Hat Enterprise Linux High Availability TUS (v.8.8)Fixed RHSA-2026:84844
Red Hat Enterprise Linux HighAvailability (v. 8)Fixed RHSA-2026:84798
Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4)Fixed RHSA-2026:84843
Red Hat Enterprise Linux Resilient Storage (v. 9)Fixed RHSA-2025:2471
Red Hat Enterprise Linux Resilient Storage EUS (v.9.2)Fixed RHSA-2025:3108
Red Hat Enterprise Linux Resilient Storage EUS (v.9.4)Fixed RHSA-2025:2470
Red Hat Enterprise Linux ResilientStorage (v. 8)Fixed RHSA-2026:84798
Red Hat OpenShift AI 3.5Fixed RHSA-2026:86891
Not affected: 8 products
  • Lightspeed Core
  • OpenShift Lightspeed
  • Red Hat Ansible Automation Platform 2
  • Red Hat Enterprise Linux 10
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.5
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenStack Platform 17.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-14029
  2. 2026-10-03 Alias added: GHSA-hr42-gv84-2f3g
  3. 2026-10-09 Affected versions changed · Red Hat
  4. 2026-10-10 Fix available: RHSA-2024:10836 · Red Hat
  5. 2026-10-10 Fix available: RHSA-2024:10590 · Red Hat
  6. 2026-10-10 Fix available: RHSA-2024:10843 · Red Hat
  7. 2026-10-10 Fix available: RHSA-2025:2470 · Red Hat
  8. 2026-10-10 Fix available: RHSA-2025:2471 · Red Hat
  9. 2026-10-10 Fix available: RHSA-2025:3108 · Red Hat
  10. 2026-10-10 Fix available: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux AppStream EUS (v.9.2), Red Hat Enterprise Linux AppStream EUS (v.9.4) +6 · Red Hat
  11. 2026-10-16 Affected versions changed · Red Hat
  12. 2026-10-20 Fix available: RHSA-2026:84798 · Red Hat
  13. 2026-10-20 Fix available: RHSA-2026:84844 · Red Hat
  14. 2026-10-20 Fix available: RHSA-2026:85135 · Red Hat
  15. 2026-10-20 Fix available: RHSA-2026:84843 · Red Hat
  16. 2026-10-20 Fix available: Red Hat Enterprise Linux High Availability AUS (v.8.4), Red Hat Enterprise Linux High Availability E4S (v.8.8), Red Hat Enterprise Linux High Availability EUS EXTENSION (v.8.6) +4 · Red Hat
  17. 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
  18. 2026-10-22 Fix available: Red Hat OpenShift AI 3.5 · Red Hat
  19. 2026-11-06 Fix available: RHSA-2026:84844 · Red Hat

References

Advisory 1

  • TI-2026-65637 Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient CVSS 4.0HIGH 8.7
  • TI-2026-62120 Tornado before 6.5.8 Memory Amplification DoS via multipart CVSS 4.0HIGH 8.7
  • TI-2026-65638 Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink CVSS 4.0HIGH 8.2
  • TI-2026-62122 Tornado before 6.5.7 Credential Leak via Handle Reuse CVSS 4.0HIGH 8.2
  • TI-2026-62121 Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs CVSS 4.0MEDIUM 6.3
  • TI-2026-86676 Path traversal in Tornado static_url() version hashing CVSS 4.0HIGH 8.3
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences