# CVE-2024-14029: Tornado HTTP request smuggling via duplicate Transfer-Encoding headers

Source: https://junglewise.ai/threats/cve-2024-14029-tornado-http-request-smuggling-via-duplicate-transfer-encoding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2024-14029 · Severity: high · CVSS 7.5 · Published 2026-09-15

Tornado is a popular Python web server framework used to build high-performance web applications. When deployed behind proxy servers, Tornado mishandles HTTP requests containing duplicate Transfer-Encoding headers, allowing attackers to smuggle malicious requests through to the backend. This can lead to bypassing access controls, poisoning cached content, or disrupting legitimate user connections.

Technologies: [tornado (PyPI)](https://junglewise.ai/threats/technologies/tornado). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-14029 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-14029 being exploited in the wild.

**How severe is CVE-2024-14029?** High severity, with a CVSS score of 7.5, published 15 September 2026.

**Which products and versions are affected?** tornado (PyPI) ECOSYSTEM:introduced=0,fixed=6.4.1.

**Is there a fix for CVE-2024-14029?** Yes. tornado (PyPI): upgrade to 6.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-14029 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-14029?** Check whether you run tornado (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tornado (PyPI): upgrade to 6.4.1 or later

  ```sh
  pip install "tornado>=6.4.1"
  ```


## Technical details

The vulnerability is an HTTP request smuggling issue (CWE-444) caused by Tornado's inconsistent parsing of duplicate Transfer-Encoding: chunked headers. When Tornado receives two Transfer-Encoding: chunked headers, it ignores both and treats the request as having no message body, while a proxy in front of it may parse the request differently. An attacker can craft a request where the proxy forwards the chunked body as the request body, but Tornado interprets it as a separate HTTP request. This occurs when Tornado is deployed behind proxies like Pound that emit duplicate Transfer-Encoding headers. The attack requires network access to the proxy-fronted Tornado instance and no authentication. Attackers can achieve ACL bypass, cache poisoning, or connection desynchronization. The vulnerability is fixed in Tornado 6.4.1 and later.

## Affected products

- Tornado Tornado before 6.4.1

## Identifiers

- CVE-2024-14029
- GHSA-753j-mpmx-qq6g

## Timeline

- 2024-06-06: disclosed: GitHub Security Advisory GHSA-753j-mpmx-qq6g published
- 2024-06-06: patched: Fix released in Tornado 6.4.1
- 2026-09-15: advisory: CVE-2024-14029 published

## References

- [https://github.com/tornadoweb/tornado/security/advisories/GHSA-753j-mpmx-qq6g](https://github.com/tornadoweb/tornado/security/advisories/GHSA-753j-mpmx-qq6g)
- [https://www.vulncheck.com/advisories/tornado-before-6.4.1-http-request-smuggling-via-transfer-encoding](https://www.vulncheck.com/advisories/tornado-before-6.4.1-http-request-smuggling-via-transfer-encoding)

## Related threats

- [Tornado open redirect in RedirectHandler URL templates](https://junglewise.ai/threats/cve-2026-116578-tornado-is-a-python-web-framework-and-asynchronous-networking)
- [Tornado HTTP header parser quadratic CPU consumption via line folding](https://junglewise.ai/threats/cve-2026-116577-tornado-is-a-python-web-framework-and-asynchronous-networking)
- [Tornado HTTP/1.1 chunked encoding denial of service](https://junglewise.ai/threats/cve-2026-115927-tornado-is-a-python-web-framework-and-asynchronous-networking)
- [Tornado StaticFileHandler path traversal via symlinks](https://junglewise.ai/threats/cve-2026-103263-tornado-staticfilehandler-follows-symlinks-outside-static-root)
- [Tornado CurlAsyncHTTPClient unbounded memory accumulation in decompression](https://junglewise.ai/threats/cve-2026-103262-tornado-curlasynchttpclient-enforces-no-response-size-limit)