CVE-2024-58384
Received Received - Intake

CRLF Injection in Tornado CurlAsyncHTTPClient

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2024-58384
EUVD
EUVD-2024-55766

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tornadoweb tornado to 6.4.1 (exc)
tornado tornado to 6.4.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-113 The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Tornado before 6.4.1 has a CRLF injection vulnerability in CurlAsyncHTTPClient. It fails to block carriage return and line feed characters in request headers. Attackers can inject these sequences to add arbitrary headers or create new HTTP requests.

Detection Guidance

To detect this vulnerability, inspect HTTP requests for CRLF sequences in headers. Use tools like tcpdump or Wireshark to capture and analyze network traffic for injected carriage return (CR) or line feed (LF) characters in header values. Check application logs for malformed requests or unusual header patterns.

Impact Analysis

An attacker could manipulate HTTP headers to bypass security controls, redirect responses, or perform cache poisoning. This may lead to unauthorized access, data leaks, or service disruption if exploited.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's confidentiality requirements or HIPAA's safeguards for protected health information. Non-compliance risks fines and legal penalties.

Mitigation Strategies

Upgrade Tornado to version 6.4.1 or later to address the CRLF injection flaw. If upgrading is not immediately possible, implement input validation to reject CR and LF characters in HTTP headers. Configure web application firewalls to block requests containing CRLF sequences.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-58384. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart