CVE-2023-54397: Tornadoweb Tornado

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.

Affected products

• Tornadoweb Tornado: before 6.3.3 (fixed in 6.3.3)

Published 2026-09-15. Last modified 2026-09-17.