Bug 2542521

Summary: CVE-2023-54397 python-tornado: Tornado before 6.3.3 HTTP Request Smuggling via Content-Length [epel-all]
Product: [Fedora] Fedora EPEL Reporter: Joel Chamberlain <jochambe>
Component: python-tornadoAssignee: Aurelien Bompard <aurelien>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: urgent Docs Contact:
Priority: urgent    
Version: epel10CC: aurelien, mhroncok, orion, python-packagers-sig, rcallicotte
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["150c2c2b-4f13-4193-9c41-5c370a875185"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2533932    

Description Joel Chamberlain 2026-09-28 15:17:51 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.