Vulnpedia
← All CVEs

CVE-2024-14029

CRITICAL 9 ALL-YEARS

Published 2026-09-15 · Last modified 2026-09-15 · VulnCheck · NVD: Deferred

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.

ELEVATED IMPACT

Severe if exploited (CVSS 9), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 30th percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation poc, automatable no

Impact if exploited

9CVSS 4.0 · CRITICAL · CNA

  • ConfidentialityLow
  • IntegrityHigh
  • AvailabilityNone

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ⚠Complexity: Needs a race window or specific setup
  • ⚠Requirements: Specific conditions must be present

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Tornadoweb

Products Tornado

Weakness (CWE)

  • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • tornado PyPI

    pkg:pypi/tornado

    ECOSYSTEM range
    • All earlier versions (introduced 0)
    • Fixed boundary (excluded): 6.4.1
    72 explicitly listed affected versions

    0.2, 1.0, 1.1, 1.1.1, 1.2, 1.2.1, 2.0, 2.1, 2.1.1, 2.2, 2.2.1, 2.3, 2.4, 2.4.1, 3.0, 3.0.1, 3.0.2, 3.1, 3.1.1, 3.2, 3.2.1, 3.2.2, 4.0, 4.0.1, 4.0.2, 4.1, 4.1b2, 4.2, 4.2.1, 4.2b1, 4.3, 4.3b1, 4.3b2, 4.4, 4.4.1, 4.4.2, 4.4.3, 4.4b1, 4.5, 4.5.1, 4.5.2, 4.5.3, 4.5b1, 4.5b2, 5.0, 5.0.1, 5.0.2, 5.0a1, 5.0b1, 5.1, 5.1.1, 5.1b1, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0a1, 6.0b1, 6.1, 6.1b1, 6.1b2, 6.2, 6.2b1, 6.2b2, 6.3, 6.3.1, 6.3.2, 6.3.3, 6.3b1, 6.4, 6.4b1

    Additional upstream package constraints
    {
  "database": {
    "last_known_affected_version_range": "<= 6.4.0",
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-753j-mpmx-qq6g/GHSA-753j-mpmx-qq6g.json"
  }
}
    GitHub Advisory Database · GHSA-753j-mpmx-qq6g · Updated 2026-09-16T03:56:03.776164621Z

Vendor product assessments

Showing 32 of 553 vendor product statements; 521 omitted. Read the full vendor advisory.

  • python-tornado-0:6.4.2-1.el9_2.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.2) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=src

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • python-tornado-0:6.4.2-1.el9_4.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_4?arch=src

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • python3-tornado-debuginfo-0:6.4.2-1.el9_4.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_4?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • python3-tornado-debuginfo-0:6.4.2-1.el9_5.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_5?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • pcs-0:0.10.8-1.el8_4.12.src as a component of Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_4.12?arch=src

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • pcs-snmp-0:0.10.15-4.el8_8.12.x86_64 as a component of Red Hat Enterprise Linux High Availability TUS (v.8.8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8.12?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • pcs-0:0.11.7-2.el9_4.3.s390x as a component of Red Hat Enterprise Linux High Availability EUS (v.9.4) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_4.3?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • pcs-snmp-0:0.11.8-1.el9_5.2.ppc64le as a component of Red Hat Enterprise Linux High Availability (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_5.2?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • pcs-0:0.10.18-2.el8_10.10.src as a component of Red Hat Enterprise Linux ResilientStorage (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10.10?arch=src

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • pcs-0:0.11.7-2.el9_4.3.ppc64le as a component of Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_4.3?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • pcs-snmp-0:0.11.8-1.el9_5.2.x86_64 as a component of Red Hat Enterprise Linux Resilient Storage (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_5.2?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • python-tornado as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/python-tornado

    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    • none available: Affected
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • python-tornado-doc as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/python-tornado-doc

    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    • none available: Affected
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • rhelai3/bootc-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-cuda-rhel9@sha256:e0fbb896811ab54d183e23612030072b946674824bad697bf2b3f68362651662?repository_url=registry.redhat.io/rhelai3/bootc-cuda-rhel9

    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    • none available: Affected
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • rhelai3/bootc-gaudi-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-gaudi-rhel9@sha256:e1057b59ca1be9501332abf97230855e85c7df858356be0da9dce230ea7e98e1?repository_url=registry.redhat.io/rhelai3/bootc-gaudi-rhel9

    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    • no fix planned: Will not fix
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • rhelai3/disk-image-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/disk-image-cuda-rhel9@sha256:9d807c5381e81734b6303669421b265aea1eca54a18ca577d453508ffde1770c?repository_url=registry.redhat.io/rhelai3/disk-image-cuda-rhel9

    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    • none available: Affected
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • rhosp-rhel8/openstack-cinder-backup as a component of Red Hat OpenStack Platform 16.2 · known affected

    Vendor assessment for this product only.

    pkg:oci/openstack-cinder-backup@sha256:2ea0f1758551777be62b1c42c4f23b2fee1e172cf8e5bfb7986bcae3fd940e22?repository_url=registry.redhat.io/rhosp-rhel8/openstack-cinder-backup

    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    • none available: Affected
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • rhosp-rhel8/openstack-cinder-volume as a component of Red Hat OpenStack Platform 16.2 · known affected

    Vendor assessment for this product only.

    pkg:oci/openstack-cinder-volume@sha256:108d3a26be8132c496bb11af28f0c065fd2c903d72ab3c35505d9e08fb6be12f?repository_url=registry.redhat.io/rhosp-rhel8/openstack-cinder-volume

    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    • none available: Affected
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • rhosp-rhel8/openstack-manila-share as a component of Red Hat OpenStack Platform 16.2 · known affected

    Vendor assessment for this product only.

    pkg:oci/openstack-manila-share@sha256:c5d13016d5986ad584194e8f3d38afb74b119cfb01cd44f7503af8491416cbc7?repository_url=registry.redhat.io/rhosp-rhel8/openstack-manila-share

    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    • none available: Affected
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • rhosp-rhel8/openstack-mariadb as a component of Red Hat OpenStack Platform 16.2 · known affected

    Vendor assessment for this product only.

    pkg:oci/openstack-mariadb@sha256:907adbb571120fb91473d982a117ee61fa54ed5c2c309e171eb55612b3ae8f46?repository_url=registry.redhat.io/rhosp-rhel8/openstack-mariadb

    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    • none available: Affected
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • rhosp-rhel8/openstack-rabbitmq as a component of Red Hat OpenStack Platform 16.2 · known affected

    Vendor assessment for this product only.

    pkg:oci/openstack-rabbitmq@sha256:950955f4f3aad6f07d3984592ca240c5f14912a5b1db629ed62bcfd20180442d?repository_url=registry.redhat.io/rhosp-rhel8/openstack-rabbitmq

    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    • none available: Affected
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • rhosp-rhel8/openstack-redis as a component of Red Hat OpenStack Platform 16.2 · known affected

    Vendor assessment for this product only.

    pkg:oci/openstack-redis@sha256:068aa1a4181ce992f44b01bf81f4134ce6288a085ce49ccae53cb572157feace?repository_url=registry.redhat.io/rhosp-rhel8/openstack-redis

    • workaround: Configure upstream reverse proxies or load balancers to strictly normalize HTTP headers and reject any incoming requests containing duplicate Transfer-Encoding headers before they reach the backend Tornado application worker.
    • none available: Affected
    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • registry.redhat.io/rhoai/odh-ai-gateway-operator-rhel9@sha256:3f59cdb3c2978ec98973d54226b23e3f106a872d25eab72590f834b7da2994af_s390x as a component of Red Hat OpenShift AI 3.5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-ai-gateway-operator-rhel9@sha256%3A3f59cdb3c2978ec98973d54226b23e3f106a872d25eab72590f834b7da2994af?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-ai-gateway-operator-rhel9&tag=1791988137

    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • registry.redhat.io/rhoai/odh-eval-hub-rhel9@sha256:e5d67c0d0cd38ff9eab982fda1c2e6cdb5e97ebce54a2b501ca3d5d19e131906_amd64 as a component of Red Hat OpenShift AI 3.5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-eval-hub-rhel9@sha256%3Ae5d67c0d0cd38ff9eab982fda1c2e6cdb5e97ebce54a2b501ca3d5d19e131906?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-eval-hub-rhel9&tag=1791946053

    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • registry.redhat.io/rhoai/odh-kserve-localmodelnode-agent-rhel9@sha256:d5e6cf3d83ff4b2f1610f7352d12771df978471a910e9797e4759a3e477b3261_amd64 as a component of Red Hat OpenShift AI 3.5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-kserve-localmodelnode-agent-rhel9@sha256%3Ad5e6cf3d83ff4b2f1610f7352d12771df978471a910e9797e4759a3e477b3261?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-kserve-localmodelnode-agent-rhel9&tag=1791949630

    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • registry.redhat.io/rhoai/odh-llm-d-batch-gateway-processor-rhel9@sha256:683d1f2e57b2e5212019b164a3e908e83872e6616c4eddcd38697d093686804e_arm64 as a component of Red Hat OpenShift AI 3.5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-llm-d-batch-gateway-processor-rhel9@sha256%3A683d1f2e57b2e5212019b164a3e908e83872e6616c4eddcd38697d093686804e?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-llm-d-batch-gateway-processor-rhel9&tag=1791949062

    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • registry.redhat.io/rhoai/odh-mlserver-cuda-rhel9@sha256:fa8b099930cd6b60a73b72d3e3a054615591c94c5b8734e6736ed4511b61b8a3_arm64 as a component of Red Hat OpenShift AI 3.5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-mlserver-cuda-rhel9@sha256%3Afa8b099930cd6b60a73b72d3e3a054615591c94c5b8734e6736ed4511b61b8a3?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-mlserver-cuda-rhel9&tag=1790962549

    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • registry.redhat.io/rhoai/odh-model-performance-data-rhel9@sha256:3bb692f4856da5d3a364b4b37b66da7cfc21c559875800c0b9c91fd58d1b2e4f_arm64 as a component of Red Hat OpenShift AI 3.5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-model-performance-data-rhel9@sha256%3A3bb692f4856da5d3a364b4b37b66da7cfc21c559875800c0b9c91fd58d1b2e4f?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-model-performance-data-rhel9&tag=1790962474

    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • registry.redhat.io/rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9@sha256:36c28a270b8244026113af32bc593d7346360a710da78061ab3075809b4bc2b6_amd64 as a component of Red Hat OpenShift AI 3.5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-pipeline-runtime-pytorch-cuda-py312-rhel9@sha256%3A36c28a270b8244026113af32bc593d7346360a710da78061ab3075809b4bc2b6?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9&tag=1791816462

    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • registry.redhat.io/rhoai/odh-training-rocm64-torch29-py312-rhel9@sha256:bf92266597ce7a7931391590168abf8387bd531e42ee6f47d0903535fea2459a_amd64 as a component of Red Hat OpenShift AI 3.5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-training-rocm64-torch29-py312-rhel9@sha256%3Abf92266597ce7a7931391590168abf8387bd531e42ee6f47d0903535fea2459a?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-training-rocm64-torch29-py312-rhel9&tag=1791926972

    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • registry.redhat.io/rhoai/rhai-cli-rhel9@sha256:7063100cab54fb0662809c17daa09e7ee74316eebcb4699d7ea870e09d4a30ad_amd64 as a component of Red Hat OpenShift AI 3.5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/rhoai/odh-cli-rhel9@sha256%3A7063100cab54fb0662809c17daa09e7ee74316eebcb4699d7ea870e09d4a30ad?arch=amd64&repository_url=registry.redhat.io/rhoai/rhai-cli-rhel9&tag=1791945905

    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00
  • rhosp-rhel9/openstack-redis as a component of Red Hat OpenStack Platform 17.1 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/openstack-redis@sha256:8096c9e75e718782eaf27f1c8375af14a13446245c2cc4ab9b5a59e4cf8f46fc?repository_url=registry.redhat.io/rhosp-rhel9/openstack-redis

    Red Hat · CVE-2024-14029 · Updated 2026-10-21T19:03:30+00:00

All CVSS metrics

  • CRITICAL 9 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N
  • HIGH 7.5 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
  • CRITICAL 9 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • HIGH 7.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

References

Exploit-tagged references (not proof of a PoC)

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS