What’s Vulnerable › Vulnerabilities

CVE-2024-58384: Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-15 · updated 2026-09-28
• Weakness: CWE-113

Description

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.

Affected products

• Pypi Tornado: before 6.4.1; 0.2, 1.0, 1.1, 1.1.1, 1.2, 1.2.1 (+66) — fixed in 6.4.1
• tornadoweb tornado: before 6.4.1 — fixed in 6.4.1

How to fix

Upgrade to a fixed version: Pypi Tornado 6.4.1; tornadoweb tornado 6.4.1. Check the vendor advisory for mitigations.

References

• https://github.com/tornadoweb/tornado/security/advisories/GHSA-w235-7p84-xx57
• https://www.vulncheck.com/advisories/tornado-before-6.4.1-crlf-injection-via-curlasynchttpclient

Get alerted when CVE-2024-58384 or the next vulnerability affects your stack