HTTP Request Smuggling Vulnerability in Tornado Web Server
CVE-2023-54397

9CRITICAL

Key Information:

Vendor

Tornadoweb

Status
Tornado
Vendor
CVE Published:
15 September 2026

What is CVE-2023-54397?

Tornado Web Server versions prior to 6.3.3 are susceptible to an HTTP request smuggling vulnerability caused by improper parsing of Content-Length headers. This flaw allows attackers to insert non-standard characters into crafted HTTP requests, which can bypass proxy validation. When Tornado is deployed behind specific proxies, this vulnerability can be exploited by attackers to smuggle requests, potentially leading to unauthorized actions or data exposure.

Affected Version(s)

tornado 0 < 6.3.3

tornado 6.3.3

References

https://github.com/tornadoweb/tornado/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/tornado-before-6.3.3...
third-party-advisory

CVSS V4

Score:
9
Severity:
CRITICAL
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

kenballus
.