Description

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-15T16:17:06.893Z",
  "pubdate": "2026-09-15T16:17:06.893Z",
  "executiveSummary": "This vulnerability involves an HTTP Request Smuggling flaw in Tornado versions prior to 6.4.1. The issue stems from the improper handling of duplicate 'Transfer-Encoding: chunked' headers, which causes the server to misinterpret the boundaries of HTTP requests.\nThe vulnerability allows an attacker to manipulate how a downstream Tornado server parses request bodies when deployed behind a front-end proxy or load balancer. By providing conflicting Transfer-Encoding headers, an attacker can induce desynchronization between the proxy and the back-end application server.\nThe primary risk implications include potential access control bypasses, unauthorized data access, cache poisoning, and the ability to inject malicious requests into the streams of other users. This vulnerability does not require authentication to exploit, as it occurs during the protocol parsing phase of the connection. Attackers can leverage this to gain unauthorized entry or disrupt service stability in environments relying on proxy-to-Tornado architectures.",
  "technicalDetails": "The root cause of this vulnerability lies in the non-compliant parsing logic within Tornado’s HTTP implementation. Specifically, the server ignores duplicate 'Transfer-Encoding: chunked' headers rather than rejecting the request as malformed. When multiple 'Transfer-Encoding' headers are present, the front-end proxy may perceive the message body as chunked, while Tornado, upon receiving the duplicate headers, incorrectly defaults to treating the request as having no message body.\nThis discrepancy leads to a classic HTTP Request Smuggling scenario. In the exploitation flow, an attacker crafts a request containing both a Content-Length header and redundant Transfer-Encoding headers. The front-end proxy consumes the request based on the chunked encoding, but because Tornado ignores the duplicate headers and assumes no body exists, the remaining portion of the attacker's payload—which is intended to be the body—is left in the socket buffer.\nTornado interprets this residual data as a subsequent, independent HTTP request. Because the server maintains a persistent connection with the proxy, this 'smuggled' request is processed as if it originated from a new user or a legitimate preceding request. This behavior enables the attacker to prefix the request of the next user in the connection queue with the smuggled content, effectively performing request hijacking.\nThe attack is highly effective in environments where Tornado resides behind a load balancer or reverse proxy that correctly adheres to RFC standards, while Tornado itself fails to validate the header integrity. No specific privilege is required to initiate this attack, and the network exposure is broad, as it targets the HTTP protocol parsing layer accessible via any public-facing endpoint.\nPost-exploitation impact ranges from severe cache poisoning, where legitimate content is replaced with malicious payloads, to authorization bypasses, as the attacker can manipulate the headers of the subsequent 'smuggled' request to include elevated session tokens or modify destination paths. This desynchronization significantly undermines the security boundary enforced by the front-end proxy."
}