CVE-2024-58384
Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient
- State
- Published
- Severity
- 6.3 Medium
- Published
- Sep 15, 2026
- Updated
- Sep 17, 2026
- Reserved
- Aug 16, 2026
Description
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Affected Products
| Product | Versions |
|---|---|
tornadotornadoweb |
|
References
- GitHub Security Advisory (GHSA-w235-7p84-xx57)vendor-advisory
- VulnCheck Advisory: Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClientthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.