What is GHSA-rhr2-ccgv-xvgx?

GHSA-rhr2-ccgv-xvgx is a security advisory published by GitHub Security Advisories with Critical severity. Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of...

Which CVE IDs does GHSA-rhr2-ccgv-xvgx cover?

GHSA-rhr2-ccgv-xvgx covers the following CVE IDs: CVE-2023-54397. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rhr2-ccgv-xvgx?

GHSA-rhr2-ccgv-xvgx has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-rhr2-ccgv-xvgxCriticalCVSS 7.5

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of...

Vendor

GitHub Security Advisories

Published

September 15, 2026

Last Modified

September 15, 2026

🔗 CVE IDs covered (1)

CVE-2023-54397 →

📋 Description

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.

🔗 References (4)

https://github.com/tornadoweb/tornado/security/advisories/GHSA-qppv-j76h-2rpx
https://nvd.nist.gov/vuln/detail/CVE-2023-54397
https://www.vulncheck.com/advisories/tornado-before-6.3.3-http-request-smuggling-via-content-length
https://github.com/advisories/GHSA-rhr2-ccgv-xvgx