high 7.5

CVE-2024-14029 json

Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

published 2024-06-06 2 y ago modified 2026-09-28 42 d ago also EUVD-2024-55765 , GHSA-753j-mpmx-qq6g

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 30%
public exploits: 0; none known

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.

Patch / fix

fixed in 2 distros 5 links 1

pypi tornado 6.4.1
tornadoweb tornado 6.4.1

debian ubuntu red hat almalinux rocky linux

python-tornado Debian 14, Debian 13 6.4.1-1

debian advisories DEBIAN-CVE-2024-14029

python-tornado Ubuntu 24.04 LTS 6.4.0-1ubuntu0.6
python-tornado Ubuntu Pro 16.04 LTS 4.2.1-1ubuntu3.1+esm4
python-tornado Ubuntu Pro 18.04 LTS 4.5.3-1ubuntu0.2+esm4
python-tornado Ubuntu Pro 22.04 LTS 6.1.0-3ubuntu0.1~esm6

ubuntu advisories UBUNTU-CVE-2024-14029

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

pcs RHEL 8 0.10.18-2.el8_10.10
pcs-snmp RHEL 8 0.10.18-2.el8_10.10
pcs RHEL 9 0.11.8-1.el9_5.2
pcs-snmp RHEL 9 0.11.8-1.el9_5.2
python-tornado RHEL 9 6.4.2-1.el9_5
python3-tornado RHEL 9 6.4.2-1.el9_5
pcs RHEL 8.6 EUS_LONG_LIFE 0.10.12-6.el8_6.14
pcs-snmp RHEL 8.6 EUS_LONG_LIFE 0.10.12-6.el8_6.14

red hat advisories RHSA-2026:85135 RHSA-2026:84844 RHSA-2026:84843 RHSA-2026:84798 RHSA-2025:3108 RHSA-2025:2470

pcs AlmaLinux 8 0.10.18-2.el8_10.10.alma.1
pcs-snmp AlmaLinux 8 0.10.18-2.el8_10.10.alma.1

almalinux advisories ALSA-2026:84798

pcs Rocky Linux 8 0.10.18-2.el8_10.10

rocky linux advisories RLSA-2026:84798

github.com/tornadoweb/tornado@d65f6e7 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-14029 updated 2026-11-04 cvss 7.5

python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

Red Hat Enterprise Linux 7 python-tornado
affected: workaround, no fix available
Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat OpenStack Platform 16.2 rhosp-rhel8/openstack-redis, rhosp-rhel8/openstack-haproxy, rhosp-rhel8/openstack-mariadb, rhosp-rhel8/openstack-rabbitmq, rhosp-rhel8/openstack-ovn-northd, rhosp-rhel8/openstack-manila-share, +2 more
affected: workaround, no fix available
Red Hat Enterprise Linux AppStream (v. 9) python-tornado 6.4.2-1.el9_5, python3-tornado 6.4.2-1.el9_5
fixed: vendor fix RHSA-2024:10590
Red Hat Enterprise Linux AppStream EUS (v.9.2) python-tornado 6.4.2-1.el9_2, python3-tornado 6.4.2-1.el9_2
fixed: vendor fix RHSA-2024:10836
Red Hat Enterprise Linux AppStream EUS (v.9.4) python-tornado 6.4.2-1.el9_4, python3-tornado 6.4.2-1.el9_4
fixed: vendor fix RHSA-2024:10843
Red Hat Enterprise Linux High Availability (v. 9) pcs 0.11.8-1.el9_5.2, pcs-snmp 0.11.8-1.el9_5.2
fixed: vendor fix RHSA-2025:2471
Red Hat Enterprise Linux High Availability AUS (v.8.4) pcs 0.10.8-1.el8_4.12, pcs-snmp 0.10.8-1.el8_4.12
fixed: vendor fix RHSA-2026:84843

show 13 more

Red Hat Enterprise Linux High Availability E4S (v.8.8) pcs 0.10.15-4.el8_8.12, pcs-snmp 0.10.15-4.el8_8.12
fixed: vendor fix RHSA-2026:84844
Red Hat Enterprise Linux High Availability EUS (v.9.2) pcs 0.11.4-7.el9_2.4, pcs-snmp 0.11.4-7.el9_2.4
fixed: vendor fix RHSA-2025:3108
Red Hat Enterprise Linux High Availability EUS (v.9.4) pcs 0.11.7-2.el9_4.3, pcs-snmp 0.11.7-2.el9_4.3
fixed: vendor fix RHSA-2025:2470
Red Hat Enterprise Linux High Availability EUS EXTENSION (v.8.6) pcs 0.10.12-6.el8_6.14, pcs-snmp 0.10.12-6.el8_6.14
fixed: vendor fix RHSA-2026:85135
Red Hat Enterprise Linux High Availability TUS (v.8.8) pcs 0.10.15-4.el8_8.12, pcs-snmp 0.10.15-4.el8_8.12
fixed: vendor fix RHSA-2026:84844
Red Hat Enterprise Linux HighAvailability (v. 8) pcs 0.10.18-2.el8_10.10, pcs-snmp 0.10.18-2.el8_10.10
fixed: vendor fix RHSA-2026:84798
Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) pcs 0.10.8-1.el8_4.12, pcs-snmp 0.10.8-1.el8_4.12
fixed: vendor fix RHSA-2026:84843
Red Hat Enterprise Linux Resilient Storage (v. 9) pcs 0.11.8-1.el9_5.2, pcs-snmp 0.11.8-1.el9_5.2
fixed: vendor fix RHSA-2025:2471
Red Hat Enterprise Linux Resilient Storage EUS (v.9.2) pcs 0.11.4-7.el9_2.4, pcs-snmp 0.11.4-7.el9_2.4
fixed: vendor fix RHSA-2025:3108
Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) pcs 0.11.7-2.el9_4.3, pcs-snmp 0.11.7-2.el9_4.3
fixed: vendor fix RHSA-2025:2470
Red Hat Enterprise Linux ResilientStorage (v. 8) pcs 0.10.18-2.el8_10.10, pcs-snmp 0.10.18-2.el8_10.10
fixed: vendor fix RHSA-2026:84798
Red Hat OpenShift AI 3.5 rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 1791816223, rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 1791816316, rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 1791899290, rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 1791816175
fixed: vendor fix RHSA-2026:86891
Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9, lightspeed-core/lightspeed-stack-rhel9, lightspeed-core/rag-tool-cuda-12.9-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-ocp-rag-rhel9 Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/lightspeed-chatbot-rhel9, ansible-automation-platform-27/lightspeed-chatbot-rhel9 Red Hat Enterprise Linux 10 python-tornado Red Hat OpenShift AI (RHOAI) rhoai/odh-feature-server-rhel9, rhoai/odh-llama-stack-core-rhel9, rhoai/odh-th-torch-cpu-py312-rhel9, rhoai/odh-th-torch-cuda-py312-rhel9, rhoai/odh-th-torch-rocm-py312-rhel9, rhoai/odh-th06-cpu-torch210-py312-rhel9, +19 more Red Hat OpenShift AI 3.5 rhoai/odh-cli-rhel9 1791945905, rhoai/rhai-cli-rhel9 1791945905, rhoai/odh-automl-rhel9 1791916705, rhoai/odh-mlflow-rhel9 1791947857, rhoai/odh-autorag-rhel9 1791903266, rhoai/odh-trainer-rhel9 1791952138, +109 more

+2 more productsfewer

Red Hat OpenShift Container Platform 4 python-tornado, python-flit 3.9.0-3.1.el9ocp, python-pep517 0.13.0-5.2.el9ocp Red Hat OpenStack Platform 17.1 rhosp-rhel9/openstack-redis, rhosp-rhel9/openstack-haproxy, rhosp-rhel9/openstack-mariadb, rhosp-rhel9/openstack-rabbitmq, rhosp-rhel9/openstack-ovn-northd, rhosp-rhel9/openstack-manila-share, +2 more

not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 54 d ago (2026-09-15)

Exploit prediction

0.36% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/tornadoweb/tornado/security/advisories/GHSA-753j-mpmx-qq6g referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.0	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
GitHub	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CNA	4.0	9.0	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem	package	affected	fixed in
pypi	tornado	<6.4.1	6.4.1

Affected products

tornadoweb tornado

Classification

Weakness

CWE-444 Inconsistent Interpretation of HTTP Requests

References

github.com /tornadoweb/tornado/commit/d65f6e71a77f53a1ff0a0dc55704be13f04eb572
web
github.com /tornadoweb/tornado/security/advisories/GHSA-753j-mpmx-qq6g
vendor-advisory, exploit, web
vulncheck.com /advisories/tornado-before-6.4.1-http-request-smuggling-via-transfer-encoding
third-party-advisory
github.com /tornadoweb/tornado
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary