CVE-2024-14029

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.4.1

Description Tornado ignores duplicate Transfer-Encoding: chunked headers, which leads the server to treat requests as having no message body. Consequently, the chunked body is parsed as a subsequent request. When deployed behind proxies that forward requests containing multiple Transfer-Encoding: chunked headers, this inconsistency allows for HTTP request smuggling. This can result in access control bypass, cache poisoning, or connection desynchronization.

Recommendations Update Tornado to version 6.4.1 or later.