high7.5
CVE-2023-54397
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters.
Impact
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.
Affected products
| Product | Affected versions |
|---|---|
| Tornado | before 6.3.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.