Vulnpedia
← All CVEs

CVE-2023-54397

CRITICAL 9 ALL-YEARS

Published 2026-09-15 · Last modified 2026-09-17 · VulnCheck · NVD: Deferred

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.

ELEVATED IMPACT

Severe if exploited (CVSS 9), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 31st percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable no

Impact if exploited

9CVSS 4.0 · CRITICAL · CNA

  • ConfidentialityLow
  • IntegrityHigh
  • AvailabilityNone

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ⚠Complexity: Needs a race window or specific setup
  • ⚠Requirements: Specific conditions must be present

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Tornadoweb

Products Tornado

Weakness (CWE)

  • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • tornado PyPI

    pkg:pypi/tornado

    ECOSYSTEM range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 6.3.3
    69 explicitly listed affected versions

    0.2, 1.0, 1.1, 1.1.1, 1.2, 1.2.1, 2.0, 2.1, 2.1.1, 2.2, 2.2.1, 2.3, 2.4, 2.4.1, 3.0, 3.0.1, 3.0.2, 3.1, 3.1.1, 3.2, 3.2.1, 3.2.2, 4.0, 4.0.1, 4.0.2, 4.1, 4.1b2, 4.2, 4.2.1, 4.2b1, 4.3, 4.3b1, 4.3b2, 4.4, 4.4.1, 4.4.2, 4.4.3, 4.4b1, 4.5, 4.5.1, 4.5.2, 4.5.3, 4.5b1, 4.5b2, 5.0, 5.0.1, 5.0.2, 5.0a1, 5.0b1, 5.1, 5.1.1, 5.1b1, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0a1, 6.0b1, 6.1, 6.1b1, 6.1b2, 6.2, 6.2b1, 6.2b2, 6.3, 6.3.1, 6.3.2, 6.3b1

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-qppv-j76h-2rpx/GHSA-qppv-j76h-2rpx.json"
  }
}
    GitHub Advisory Database · GHSA-qppv-j76h-2rpx · Updated 2026-09-16T03:56:01.387511075Z

Vendor product assessments

  • python-tornado as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/python-tornado

    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize or sanitize HTTP headers and reject malformed Content-Length headers before requests reach the Tornado application layer.
    • none available: Affected
    Red Hat · CVE-2023-54397 · Updated 2026-09-28T16:27:01+00:00
  • python-tornado-doc as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/python-tornado-doc

    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize or sanitize HTTP headers and reject malformed Content-Length headers before requests reach the Tornado application layer.
    • none available: Affected
    Red Hat · CVE-2023-54397 · Updated 2026-09-28T16:27:01+00:00
  • python-tornado.src as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/python-tornado?arch=src

    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize or sanitize HTTP headers and reject malformed Content-Length headers before requests reach the Tornado application layer.
    • none available: Affected
    Red Hat · CVE-2023-54397 · Updated 2026-09-28T16:27:01+00:00

All CVSS metrics

  • CRITICAL 9 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N
  • HIGH 7.5 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
  • CRITICAL 9 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • HIGH 7.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

References

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS