{"schema":"vulnpedia.research/1","cve":"CVE-2023-54397","references":[{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-qppv-j76h-2rpx","tags":["vendor-advisory","WEB","vendor-reference"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-09-15T15:17:52.261Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-09-15T15:17:52.261Z","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-qppv-j76h-2rpx"},{"source":"nvd","sourceId":"CVE-2023-54397","modified":"2026-09-17T15:16:39.103","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-qppv-j76h-2rpx"},{"source":"ghsa","sourceId":"GHSA-qppv-j76h-2rpx","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-qppv-j76h-2rpx"},{"source":"ghsa","sourceId":"GHSA-qppv-j76h-2rpx","modified":"2026-09-16T03:56:01.387511075Z","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-qppv-j76h-2rpx"},{"source":"redhat","sourceId":"CVE-2023-54397","modified":"2026-09-28T16:27:01+00:00","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-qppv-j76h-2rpx"}]},{"url":"https://www.vulncheck.com/advisories/tornado-before-6.3.3-http-request-smuggling-via-content-length","tags":["third-party-advisory","vendor-reference"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-09-15T15:17:52.261Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-09-15T15:17:52.261Z","url":"https://www.vulncheck.com/advisories/tornado-before-6.3.3-http-request-smuggling-via-content-length"},{"source":"nvd","sourceId":"CVE-2023-54397","modified":"2026-09-17T15:16:39.103","url":"https://www.vulncheck.com/advisories/tornado-before-6.3.3-http-request-smuggling-via-content-length"},{"source":"redhat","sourceId":"CVE-2023-54397","modified":"2026-09-28T16:27:01+00:00","url":"https://www.vulncheck.com/advisories/tornado-before-6.3.3-http-request-smuggling-via-content-length"}]},{"url":"https://osv.dev/vulnerability/GHSA-qppv-j76h-2rpx","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-qppv-j76h-2rpx","modified":"2026-09-16T03:56:01.387511075Z","origins":[{"source":"ghsa","sourceId":"GHSA-qppv-j76h-2rpx","url":"https://osv.dev/vulnerability/GHSA-qppv-j76h-2rpx"},{"source":"ghsa","sourceId":"GHSA-qppv-j76h-2rpx","modified":"2026-09-16T03:56:01.387511075Z","url":"https://osv.dev/vulnerability/GHSA-qppv-j76h-2rpx"}]},{"url":"https://github.com/tornadoweb/tornado/commit/b7a5dd29bb02950303ae96055082c12a1ea0a4fe","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-qppv-j76h-2rpx","modified":"2026-09-16T03:56:01.387511075Z","origins":[{"source":"ghsa","sourceId":"GHSA-qppv-j76h-2rpx","url":"https://github.com/tornadoweb/tornado/commit/b7a5dd29bb02950303ae96055082c12a1ea0a4fe"},{"source":"ghsa","sourceId":"GHSA-qppv-j76h-2rpx","modified":"2026-09-16T03:56:01.387511075Z","url":"https://github.com/tornadoweb/tornado/commit/b7a5dd29bb02950303ae96055082c12a1ea0a4fe"}]},{"url":"https://github.com/tornadoweb/tornado","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-qppv-j76h-2rpx","modified":"2026-09-16T03:56:01.387511075Z","origins":[{"source":"ghsa","sourceId":"GHSA-qppv-j76h-2rpx","url":"https://github.com/tornadoweb/tornado"},{"source":"ghsa","sourceId":"GHSA-qppv-j76h-2rpx","modified":"2026-09-16T03:56:01.387511075Z","url":"https://github.com/tornadoweb/tornado"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54397.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2023-54397","modified":"2026-09-28T16:27:01+00:00","origins":[{"source":"redhat","sourceId":"CVE-2023-54397","modified":"2026-09-28T16:27:01+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54397.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2023-54397","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2023-54397","modified":"2026-09-28T16:27:01+00:00","origins":[{"source":"redhat","sourceId":"CVE-2023-54397","modified":"2026-09-28T16:27:01+00:00","url":"https://access.redhat.com/security/cve/CVE-2023-54397"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533932","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2023-54397","modified":"2026-09-28T16:27:01+00:00","origins":[{"source":"redhat","sourceId":"CVE-2023-54397","modified":"2026-09-28T16:27:01+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533932"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-54397","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2023-54397","modified":"2026-09-28T16:27:01+00:00","origins":[{"source":"redhat","sourceId":"CVE-2023-54397","modified":"2026-09-28T16:27:01+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2023-54397"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54397","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2023-54397","modified":"2026-09-28T16:27:01+00:00","origins":[{"source":"redhat","sourceId":"CVE-2023-54397","modified":"2026-09-28T16:27:01+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54397"}]},{"source":"euvd","sourceId":"EUVD-2023-60690","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-60690","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2023-60690","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-60690"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-qppv-j76h-2rpx","url":"https://osv.dev/vulnerability/GHSA-qppv-j76h-2rpx","ecosystem":"PyPI","name":"tornado","purl":"pkg:pypi/tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.3"}]}],"versions":["0.2","1.0","1.1","1.1.1","1.2","1.2.1","2.0","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","3.0","3.0.1","3.0.2","3.1","3.1.1","3.2","3.2.1","3.2.2","4.0","4.0.1","4.0.2","4.1","4.1b2","4.2","4.2.1","4.2b1","4.3","4.3b1","4.3b2","4.4","4.4.1","4.4.2","4.4.3","4.4b1","4.5","4.5.1","4.5.2","4.5.3","4.5b1","4.5b2","5.0","5.0.1","5.0.2","5.0a1","5.0b1","5.1","5.1.1","5.1b1","6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0a1","6.0b1","6.1","6.1b1","6.1b2","6.2","6.2b1","6.2b2","6.3","6.3.1","6.3.2","6.3b1"],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-qppv-j76h-2rpx/GHSA-qppv-j76h-2rpx.json"},"modified":"2026-09-16T03:56:01.387511075Z","origins":[{"source":"ghsa","sourceId":"GHSA-qppv-j76h-2rpx","modified":"2026-09-16T03:56:01.387511075Z","url":"https://osv.dev/vulnerability/GHSA-qppv-j76h-2rpx"}]}],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2023-54397","modified":"2026-09-28T16:27:01+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54397.json","productId":"red_hat_enterprise_linux_7:python-tornado","product":"python-tornado as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"Configure upstream reverse proxies or load balancers to strictly normalize or sanitize HTTP headers and reject malformed Content-Length headers before requests reach the Tornado application layer."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/python-tornado","origins":[{"source":"redhat","sourceId":"CVE-2023-54397","modified":"2026-09-28T16:27:01+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54397.json"}]},{"source":"redhat","sourceId":"CVE-2023-54397","modified":"2026-09-28T16:27:01+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54397.json","productId":"red_hat_enterprise_linux_7:python-tornado-doc","product":"python-tornado-doc as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"Configure upstream reverse proxies or load balancers to strictly normalize or sanitize HTTP headers and reject malformed Content-Length headers before requests reach the Tornado application layer."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/python-tornado-doc","origins":[{"source":"redhat","sourceId":"CVE-2023-54397","modified":"2026-09-28T16:27:01+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54397.json"}]},{"source":"redhat","sourceId":"CVE-2023-54397","modified":"2026-09-28T16:27:01+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54397.json","productId":"red_hat_enterprise_linux_7:python-tornado.src","product":"python-tornado.src as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"Configure upstream reverse proxies or load balancers to strictly normalize or sanitize HTTP headers and reject malformed Content-Length headers before requests reach the Tornado application layer."},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/python-tornado?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2023-54397","modified":"2026-09-28T16:27:01+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54397.json"}]}],"vendorCoverage":{"total":3,"shown":3,"omitted":0,"source":"redhat"}}