CVE-2024-14029 Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
Attackers can perform HTTP request smuggling in Tornado by exploiting duplicate Transfer-Encoding headers, leading to access control bypass or cache poisoning.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-14029?
CVE-2024-14029 is a critical vulnerability in tornadoweb tornado, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.
Weakness: CWE-444
Which versions are affected by CVE-2024-14029?
2 open source packages ship an affected version, including tornado.
| Package | Affected | Fixed in |
|---|---|---|
tornado PyPI | All versions | 6.4.1 |
tornado PyPI | All versions | 6.4.1 |
How do I fix CVE-2024-14029?
Upgrade tornado to 6.4.1 or later.
Is CVE-2024-14029 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-14029 exists.
Sources
Also known as AZL-103101, DEBIAN-CVE-2024-14029, ECHO-d0f5-0786-800c, GHSA-753j-mpmx-qq6g, GHSA-hr42-gv84-2f3g, ROOT-APP-PYPI-GHSA-753j-mpmx-qq6g and 1 more.