MEDIUM

CVE-2024-58384

2026-09-15 CVSS v3.1

CVSS

5.4

Description

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.

Weakness (CWE)

CWE-113

EPSS Score

0.24%

Probability of exploitation in next 30 days

15.7th percentile

References

https://github.com/tornadoweb/tornado/security/advisories/GHSA-w235-7p84-xx57 https://www.vulncheck.com/advisories/tornado-before-6.4.1-crlf-injection-via-curlasynchttpclient

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE