CVE-2023-54397

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-54397", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-15T11:12:19.647Z", "datePublished": "2026-09-15T15:17:52.261Z", "dateUpdated": "2026-09-17T14:48:55.089Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-15T15:17:52.261Z"}, "datePublic": "2023-08-12T00:00:00.000Z", "title": "Tornado before 6.3.3 HTTP Request Smuggling via Content-Length", "descriptions": [{"lang": "en", "value": "Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "cweId": "CWE-444", "type": "CWE"}]}], "affected": [{"vendor": "tornadoweb", "product": "tornado", "defaultStatus": "unaffected", "packageURL": "pkg:pypi/tornado", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "6.3.3"}, {"version": "6.3.3", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.3.3"}]}]}], "metrics": [{"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 9, "baseSeverity": "CRITICAL", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-qppv-j76h-2rpx", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-qppv-j76h-2rpx)"}, {"name": "VulnCheck Advisory: Tornado before 6.3.3 HTTP Request Smuggling via Content-Length", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/tornado-before-6.3.3-http-request-smuggling-via-content-length"}], "credits": [{"lang": "en", "value": "kenballus", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-17T14:48:39.262559Z", "id": "CVE-2023-54397", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T14:48:55.089Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-54397", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-17T14:48:39.262559Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T14:48:45.855Z"}}], "cna": {"title": "Tornado before 6.3.3 HTTP Request Smuggling via Content-Length", "credits": [{"lang": "en", "type": "reporter", "value": "kenballus"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "tornadoweb", "product": "tornado", "versions": [{"status": "affected", "version": "0", "lessThan": "6.3.3", "versionType": "semver"}, {"status": "unaffected", "version": "6.3.3", "versionType": "semver"}], "packageURL": "pkg:pypi/tornado", "defaultStatus": "unaffected"}], "datePublic": "2023-08-12T00:00:00.000Z", "references": [{"url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-qppv-j76h-2rpx", "name": "GitHub Security Advisory (GHSA-qppv-j76h-2rpx)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/tornado-before-6.3.3-http-request-smuggling-via-content-length", "name": "VulnCheck Advisory: Tornado before 6.3.3 HTTP Request Smuggling via Content-Length", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.3.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-15T15:17:52.261Z"}}}, "cveMetadata": {"cveId": "CVE-2023-54397", "state": "PUBLISHED", "dateUpdated": "2026-09-17T14:48:55.089Z", "dateReserved": "2026-09-15T11:12:19.647Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-09-15T15:17:52.261Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:pypi/tornado", "product": "tornado", "vendor": "tornadoweb", "versions": [{"lessThan": "6.3.3", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "6.3.3", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies."}], "id": "CVE-2023-54397", "lastModified": "2026-09-17T15:16:39.103", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.7, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-54397", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-17T14:48:39.262559Z", "version": "2.0.3"}}]}, "published": "2026-09-15T16:17:05.777", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-qppv-j76h-2rpx"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/tornado-before-6.3.3-http-request-smuggling-via-content-length"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "python-tornado: Tornado before 6.3.3 HTTP Request Smuggling via Content-Length", "id": "2533932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533932"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N", "status": "draft"}, "cwe": "CWE-444", "details": ["Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.", "A flaw was found in Tornado's HTTP request header parsing logic. When processing incoming HTTP requests, Tornado fails to reject malformed Content-Length headers containing non-standard characters. An unauthenticated remote attacker can exploit this parsing discrepancy when Tornado is deployed behind a front-end proxy or load balancer to cause a request boundary mismatch. This allows the attacker to conduct HTTP request smuggling, bypass proxy-level security controls, and inject unauthorized requests directly into the backend application context."], "mitigation": {"lang": "en:us", "value": "Configure upstream reverse proxies or load balancers to strictly normalize or sanitize HTTP headers and reject malformed Content-Length headers before requests reach the Tornado application layer."}, "name": "CVE-2023-54397", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "python-tornado", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2026-09-15T15:17:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-54397\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-54397\nhttps://github.com/tornadoweb/tornado/security/advisories/GHSA-qppv-j76h-2rpx\nhttps://www.vulncheck.com/advisories/tornado-before-6.3.3-http-request-smuggling-via-content-length"], "statement": "A vulnerability was found in Tornado's HTTP header parsing logic. When deployed behind a front-end reverse proxy or load balancer, Tornado improperly accepts non-standard characters in Content-Length headers instead of rejecting the malformed request. An unauthenticated remote attacker can exploit this parsing discrepancy to bypass proxy-level security validation, leading to HTTP request smuggling, unauthorized backend access, or request hijacking.", "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.3.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.3.3"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "tornado", "source": "cna", "vendor": "tornadoweb"}, "product": "tornado", "vendor": "tornadoweb"}], "created": "2026-09-15T18:45:18.285160+00:00", "updated": "2026-09-20T16:45:07.677003+00:00", "vendors": ["tornadoweb", "tornadoweb$PRODUCT$tornado"]}