Description
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.
Remediation
References
Related Vulnerabilities
WordPress Plugin Portfolio-WordPress Portfolio Cross-Site Scripting (2.8.10)
MySQL CVE-2021-2300 Vulnerability (CVE-2021-2300)
WordPress Plugin Zephyr Project Manager Cross-Site Scripting (3.2.40)
MySQL CVE-2024-21162 Vulnerability (CVE-2024-21162)
Moodle Improper Authentication Vulnerability (CVE-2025-3627)