Vulnerability in Tornadoweb Tornado
CVE-2024-58384
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N.
Affected products
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2024-58384?
- CVE-2024-58384 is a medium-severity vulnerability in Tornadoweb Tornado, classified under HTTP Response Splitting. CVSS score: 5.4/10. Published 2026-09-15.
- How severe is CVE-2024-58384?
- Medium severity. CVSS v3 base score is 5.4 out of 10.