Is CVE-2024-14029 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-14029 being exploited in the wild.

How severe is CVE-2024-14029?

High severity, with a CVSS score of 7.5, published 15 September 2026.

Which products and versions are affected?

tornado (PyPI) ECOSYSTEM:introduced=0,fixed=6.4.1.

Is there a fix for CVE-2024-14029?

Yes. tornado (PyPI): upgrade to 6.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-14029 attacked?

It is attacked over the network.

Am I affected by CVE-2024-14029?

Check whether you run tornado (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-14029: Tornado HTTP request smuggling via duplicate Transfer-Encoding headers

CVE-2024-14029 · Severity: high · CVSS 7.5 · Published 2026-09-15

Tornado is a popular Python web server framework used to build high-performance web applications. When deployed behind proxy servers, Tornado mishandles HTTP requests containing duplicate Transfer-Encoding headers, allowing attackers to smuggle malicious requests through to the backend. This can lead to bypassing access controls, poisoning cached content, or disrupting legitimate user connections.

Technologies: tornado (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-14029 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-14029 being exploited in the wild.
How severe is CVE-2024-14029?: High severity, with a CVSS score of 7.5, published 15 September 2026.
Which products and versions are affected?: tornado (PyPI) ECOSYSTEM:introduced=0,fixed=6.4.1.
Is there a fix for CVE-2024-14029?: Yes. tornado (PyPI): upgrade to 6.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-14029 attacked?: It is attacked over the network.
Am I affected by CVE-2024-14029?: Check whether you run tornado (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tornado (PyPI): upgrade to 6.4.1 or later
```
pip install "tornado>=6.4.1"
```

Technical details

The vulnerability is an HTTP request smuggling issue (CWE-444) caused by Tornado's inconsistent parsing of duplicate Transfer-Encoding: chunked headers. When Tornado receives two Transfer-Encoding: chunked headers, it ignores both and treats the request as having no message body, while a proxy in front of it may parse the request differently. An attacker can craft a request where the proxy forwards the chunked body as the request body, but Tornado interprets it as a separate HTTP request. This occurs when Tornado is deployed behind proxies like Pound that emit duplicate Transfer-Encoding headers. The attack requires network access to the proxy-fronted Tornado instance and no authentication. Attackers can achieve ACL bypass, cache poisoning, or connection desynchronization. The vulnerability is fixed in Tornado 6.4.1 and later.

Affected products

Tornado Tornado before 6.4.1

Identifiers

CVE-2024-14029
GHSA-753j-mpmx-qq6g

Timeline

2024-06-06: disclosed: GitHub Security Advisory GHSA-753j-mpmx-qq6g published
2024-06-06: patched: Fix released in Tornado 6.4.1
2026-09-15: advisory: CVE-2024-14029 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.