CVE-2024-14029

Tornado, the Python web framework and HTTP server, mishandles requests containing duplicate 'Transfer-Encoding: chunked' headers in versions before 6.4.1. Instead of rejecting the ambiguous request, Tornado ignores the header entirely, treats the request as bodyless, and parses the chunked body as a second, smuggled request on the same connection. When Tornado runs behind a reverse proxy (e.g., nginx, a load balancer, or API gateway) that interprets duplicate Transfer-Encoding headers differently, an unauthenticated attacker can desynchronize the front-end and back-end parsers to smuggle requests — bypassing access controls, poisoning caches, hijacking other users' connections, or reaching internal endpoints. All deployments of Tornado before 6.4.1 that sit behind a proxy that accepts such headers are affected; standalone Tornado servers without a front-end proxy are not exposed to this smuggling vector. The flaw is rated critical (CVSS 4.0: 9.0) and was disclosed by VulnCheck; no public proof-of-concept or confirmed in-the-wild exploitation is known, and it is not in the CISA KEV catalog.

What to do: Upgrade Tornado to 6.4.1 or later, which properly rejects requests with duplicate Transfer-Encoding headers. As defense-in-depth, configure front-end proxies and load balancers (e.g., nginx) to reject or normalize requests containing multiple Transfer-Encoding headers or conflicting Transfer-Encoding/Content-Length headers. Review proxy and Tornado access logs for anomalous pipelined requests or responses to unseen requests, which can indicate smuggling attempts or prior abuse.