CVE-2024-58384 — Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers c…
Published: 2026-09-15 · CVSS: 6.3 · CVSS 4.0
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7