CVE-2024-14029EPSS p26.5%

CVE-2024-14029CVE-2024-14029

Description

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.

Scoring

CVSS 7.5 ()
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
EPSS0.35% probability of exploitation · percentile 26.5% · 2026-10-05T12:00:23Z
Last modified2026-09-28
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.