CVE-2023-54397
Received Received - Intake

HTTP Request Smuggling in Tornado

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2023-54397
EUVD
EUVD-2023-60690

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tornadoweb tornado to 6.3.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Tornado before version 6.3.3 has an HTTP request smuggling vulnerability caused by improper parsing of Content-Length headers. Attackers can insert non-standard characters like hyphens or underscores into these headers, which Tornado incorrectly processes. This allows bypassing proxy validation and smuggling malicious requests when the application runs behind certain proxies.

Detection Guidance

To detect this vulnerability, inspect HTTP requests for non-standard characters in Content-Length headers. Use tools like Wireshark or tcpdump to capture and analyze traffic for malformed headers. Check proxy logs for inconsistencies in request parsing. Test with crafted requests containing hyphens, plus signs, or underscores in Content-Length values.

Impact Analysis

This vulnerability could let attackers send unauthorized requests through your system by exploiting inconsistencies between Tornado and proxies. It may lead to data breaches, unauthorized access to sensitive information, or manipulation of application behavior. Systems using vulnerable Tornado versions behind proxies are at higher risk.

Compliance Impact

This vulnerability could violate compliance requirements like GDPR or HIPAA by enabling unauthorized data access or breaches. Organizations using vulnerable Tornado versions may fail to protect sensitive data, leading to legal penalties, reputational damage, or loss of certification.

Mitigation Strategies

Upgrade Tornado to version 6.3.3 or later immediately. If upgrading is not possible, implement strict input validation for HTTP headers, particularly Content-Length fields. Configure proxies to reject non-standard characters in these headers. Monitor network traffic for suspicious patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2023-54397. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart