Sign in
Deutsch English Español Polski
Medium

Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths

  • Disclosed: 14.08.2023
  • Updated: 11.10.2026 15:18

Summary

Tornado interprets -, +, and _ in chunk length and Content-Length values, which are not allowed by the HTTP RFCs. This can result in request smuggling when Tornado is deployed behind certain proxies that interpret those non-standard characters differently. This is known to apply to older versions of haproxy, although the current release is not affected.

Details

Tornado uses the int constructor to parse the values of Content-Length headers and chunk lengths in the following locations:

tornado/http1connection.py:445

python
            self._expected_content_remaining = int(headers["Content-Length"])

tornado/http1connection.py:621

python
                content_length = int(headers["Content-Length"])  # type: Optional[int]

tornado/http1connection.py:671

python
            chunk_len = int(chunk_len_str.strip(), 16)

Because int("0_0") == int("+0") == int("-0") == int("0"), using the int constructor to parse and validate strings that should contain only ASCII digits is not a good strategy.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) tornado < 6.3.3 6.3.3

References

CVSS score -
Weakness (CWE)
CWE-444
Platform
Python (PyPI)
Package
tornado
Disclosed
14.08.2023
Updated
11.10.2026 15:18

Sources and licenses

OSV / GitHub Advisory Database - GHSA-qppv-j76h-2rpx - CC BY 4.0

Vulnerability history: tornado

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (23) in the archive
Total entries
23
First → latest
05.2012 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 13
  • Medium 8
  • Low 2

Disclosures per year

earlier: 1

Severity:
  1. tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
    High · 7.5 CVE-2026-103262 < 6.5.9 6.5.9
  2. Tornado: StaticFileHandler follows symlinks outside static root (path traversal)
    High CVE-2026-103263 < 6.5.9 6.5.9
  3. Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
    High · 7.5 CVE-2026-82397 < 6.5.8 6.5.8
  4. Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
    High · 7.7 CVE-2026-49853 < 6.5.6 6.5.6
  5. tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)
    High · 7.5 CVE-2026-49855 < 6.5.6 6.5.6
  6. Tornado has cookie attribute injection via .RequestHandler.set_cookie
    High · 7.2 CVE-2026-35536 < 6.5.5 6.5.5
  7. Tornado is vulnerable to DoS due to too many multipart parts
    High · 7.5 CVE-2026-31958 < 6.5.5 6.5.5
  8. Tornado: Quadratic DoS via Crafted Multipart Parameters
    High · 7.5 CVE-2025-67726 < 6.5.3 6.5.3
  9. Tornado: Quadratic DoS via Repeated Header Coalescing
    High · 7.5 CVE-2025-67725 < 6.5.3 6.5.3
  10. Tornado vulnerable to excessive logging caused by malformed multipart form data
    High · 7.5 CVE-2025-47287 < 6.5 6.5
  11. Tornado has an HTTP cookie parsing DoS vulnerability
    High · 7.5 CVE-2024-52804 < 6.4.2 6.4.2
  12. Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths this entry
    Medium CVE-2023-54397 < 6.3.3 6.3.3
  13. Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determin
    High · 6.5 CVE-2014-9720 < 3.2.2 3.2.2
  14. CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting
    High · 7.5 CVE-2012-2374 < 2.2.1 2.2.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.