Bug 2533918 (CVE-2024-14029)

Summary: CVE-2024-14029 python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, anpicker, aos-team-art-private, asdas, bbrownin, bparees, dpaolell, dschmidt, ebourniv, eglynn, hasun, ikhan, jdelft, jfula, jjoyce, jlanda, jowilson, jpretori, jschluet, jupierce, jwong, kaycoth, kshier, lgarciaa, lhh, mbiarnes, mburns, mgarciac, nyancey, omaciel, ometelka, ppalepu, ppostler, prdhamdh, ptisnovs, rbobbitt, rhel-process-autobot, sbunciak, sghai, sidsharm, simaishi, stcannon, suppawar, syedriko, ttakamiy, vlaad, watson-tool-maintainers, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A vulnerability was discovered in Tornado where it improperly handles HTTP requests containing duplicate Transfer-Encoding: chunked headers. When duplicate Transfer-Encoding headers are present in an incoming request, Tornado ignores them and treats the request as body-less, leaving the chunked message body unparsed in the HTTP socket stream. When Tornado is deployed behind a reverse proxy or load balancer that correctly processes chunked payloads, an unauthenticated remote attacker can exploit this parsing discrepancy to conduct HTTP request smuggling, bypass proxy security restrictions, poison intermediate caches, or desynchronize backend connections.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2542532    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-15 15:49:58 UTC 
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.