CVE-2023-54397

A flaw was found in Tornado's HTTP request header parsing logic. When processing incoming HTTP requests, Tornado fails to reject malformed Content-Length headers containing non-standard characters. An unauthenticated remote attacker can exploit this parsing discrepancy when Tornado is deployed behind a front-end proxy or load balancer to cause a request boundary mismatch. This allows the attacker to conduct HTTP request smuggling, bypass proxy-level security controls, and inject unauthorized requests directly into the backend application context.

A vulnerability was found in Tornado's HTTP header parsing logic. When deployed behind a front-end reverse proxy or load balancer, Tornado improperly accepts non-standard characters in Content-Length headers instead of rejecting the malformed request. An unauthenticated remote attacker can exploit this parsing discrepancy to bypass proxy-level security validation, leading to HTTP request smuggling, unauthorized backend access, or request hijacking.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Configure upstream reverse proxies or load balancers to strictly normalize or sanitize HTTP headers and reject malformed Content-Length headers before requests reach the Tornado application layer.