Is CVE-2023-54397 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-54397 being exploited in the wild.

How severe is CVE-2023-54397?

High severity, with a CVSS score of 7.5, published 15 September 2026.

Which products and versions are affected?

tornado (PyPI) ECOSYSTEM:introduced=0,fixed=6.3.3.

Is there a fix for CVE-2023-54397?

Yes. tornado (PyPI): upgrade to 6.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-54397 attacked?

It is attacked over the network.

Am I affected by CVE-2023-54397?

Check whether you run tornado (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-54397: Tornado HTTP request smuggling in Content-Length parsing

CVE-2023-54397 · Severity: high · CVSS 7.5 · Published 2026-09-15

Tornado, a popular Python web framework, improperly parses HTTP Content-Length headers by accepting non-standard characters (hyphens, plus signs, underscores) that should not be allowed. When Tornado runs behind certain proxies that reject these characters, attackers can craft malicious HTTP requests to bypass proxy validation and inject smuggled requests into the application, potentially allowing account takeover, cache poisoning, or unauthorized data access.

Technologies: tornado (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2023-54397 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-54397 being exploited in the wild.
How severe is CVE-2023-54397?: High severity, with a CVSS score of 7.5, published 15 September 2026.
Which products and versions are affected?: tornado (PyPI) ECOSYSTEM:introduced=0,fixed=6.3.3.
Is there a fix for CVE-2023-54397?: Yes. tornado (PyPI): upgrade to 6.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-54397 attacked?: It is attacked over the network.
Am I affected by CVE-2023-54397?: Check whether you run tornado (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tornado (PyPI): upgrade to 6.3.3 or later
```
pip install "tornado>=6.3.3"
```

Technical details

Tornado versions before 6.3.3 use Python's int() constructor to parse Content-Length and chunk-length values without proper validation. The int() function accepts non-standard prefixes and separators (e.g., "+0", "-0", "0_0"), which diverge from HTTP RFC specifications that allow only ASCII digits. When deployed behind proxies that reject these non-standard formats, an attacker can send a request with ambiguous Content-Length interpretation, causing the proxy and Tornado to disagree on where the request ends, enabling HTTP request smuggling. This vulnerability is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests). The issue was patched in Tornado 6.3.3 by implementing stricter parsing logic for header values.

Affected products

Tornado Tornado before 6.3.3

Identifiers

CVE-2023-54397
GHSA-qppv-j76h-2rpx

Timeline

2023-08-12: disclosed: Security advisory published on GitHub
2023: patched: Fixed in Tornado 6.3.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.