Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: tornadoweb tornado 6.4.1 Clear all filters
TI-2024-38463 CVE-2024-58384 · GHSA-qf37-5gqv-7f3m

Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient

Priority LOW 28

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00249 Published 2026-09-15 Partial fix · 6.4.1 CWE-113
TI-2024-13023 CVE-2024-14029 · GHSA-hr42-gv84-2f3g

Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

Priority HIGH 72

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request.

CVSS 4.0CRITICAL 9.0 Network No auth No interaction EPSS 0.00361 Published 2026-09-15 Partial fix · 6.4.1 CWE-444