{"id":"CVE-2023-54397","aliases":["GHSA-qppv-j76h-2rpx"],"url":"https://o3.security/vulnerability/CVE-2023-54397","summary":"Tornado before 6.3.3 HTTP Request Smuggling via Content-Length","details":"## Summary\nTornado interprets `-`, `+`, and `_` in chunk length and `Content-Length` values, which are not allowed by the HTTP RFCs. This can result in request smuggling when Tornado is deployed behind certain proxies that interpret those non-standard characters differently. This is known to apply to older versions of haproxy, although the current release is not affected.\n\n## Details\nTornado uses the `int` constructor to parse the values of `Content-Length` headers and chunk lengths in the following locations:\n### `tornado/http1connection.py:445`\n```python3\n            self._expected_content_remaining = int(headers[\"Content-Length\"])\n```\n### `tornado/http1connection.py:621`\n```python3\n                content_length = int(headers[\"Content-Length\"])  # type: Optional[int]\n```\n### `tornado/http1connection.py:671`\n```python3\n            chunk_len = int(chunk_len_str.strip(), 16)\n```\nBecause `int(\"0_0\") == int(\"+0\") == int(\"-0\") == int(\"0\")`, using the `int` constructor to parse and validate strings that should contain only ASCII digits is not a good strategy. \n\n","published":"2026-09-15T15:17:52.261Z","modified":"2026-10-28T02:30:59.328979194Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"tornado","fixedVersion":"6.3.3"}],"fix":{"url":"https://github.com/tornadoweb/tornado/commit/b7a5dd29bb02950303ae96055082c12a1ea0a4fe","label":"tornadoweb/tornado@b7a5dd2"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54397.json"},{"type":"ADVISORY","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-qppv-j76h-2rpx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54397"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/tornado-before-6.3.3-http-request-smuggling-via-content-length"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/commit/b7a5dd29bb02950303ae96055082c12a1ea0a4fe"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:59.328979194Z"}}