Name: CVE-2024-14029: Inconsistent Interpretation of HTTP Requests
Creator: Rapid7
Published: 2026-09-15T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2024-14029, CWE-444, CVSS 7.5, EPSS 0.00361

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.

CVSS Details

CVSS 4.0 Base Score: 9 (CRITICAL)
CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVSS 3.1 Base Score: 7.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade pcsUpgrade pcs-snmp	Oct 19, 2026	Oct 19, 2026
Debian	—	Upgrade python-tornado	Sep 17, 2026	Sep 15, 2026
Oracle_linux	—	Upgrade pcs-snmpUpgrade pcs	Oct 22, 2026	Sep 15, 2026
Redhat_linux	—	Upgrade pcs-snmpNo solution existsUpgrade pcs	Sep 30, 2026	Sep 15, 2026
Rocky_linux	—	Upgrade pcsUpgrade pcs-snmp	Oct 22, 2026	Oct 20, 2026
Ubuntu	—	Upgrade python3-tornado (Ubuntu Pro)Upgrade python3-tornado	Oct 22, 2026	Sep 15, 2026

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence