CVE-2023-54397: Tornado HTTP Request Smuggling Flaw

CVE-2023-54397 Overview

CVE-2023-54397 is an HTTP Request Smuggling vulnerability [CWE-444] affecting the Tornado Python web framework in versions prior to 6.3.3. Tornado improperly parses Content-Length headers by accepting non-standard characters that upstream proxies reject or normalize differently. Attackers can exploit this parsing discrepancy to smuggle a second HTTP request past front-end proxy validation. The desynchronization between proxy and Tornado allows request queue poisoning, cache poisoning, and access control bypass when Tornado runs behind a vulnerable reverse proxy or load balancer.

Critical Impact
Attackers can bypass proxy-level security controls, poison shared caches, and hijack authenticated sessions by smuggling requests through misparsed Content-Length headers.

Affected Products

Tornado web framework versions prior to 6.3.3
Applications built on Tornado deployed behind HTTP reverse proxies
Multi-tier deployments where a front-end proxy performs request validation before forwarding to Tornado

Discovery Timeline

2026-09-15 - CVE-2023-54397 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2023-54397

Vulnerability Analysis

HTTP Request Smuggling occurs when two HTTP processors in a chain disagree about where one request ends and the next begins. Tornado versions before 6.3.3 accept Content-Length header values containing non-standard characters that the HTTP specification prohibits. A front-end proxy may reject, strip, or normalize these characters, while Tornado interprets the raw value differently. This parser discrepancy lets an attacker embed a second, hidden request inside the body of the first.

The smuggled request executes with the trust context of the proxy connection. Attackers can poison the connection queue so the next legitimate user receives an attacker-controlled response, or they can bypass proxy-enforced access controls on internal endpoints. Cache poisoning and credential theft are common downstream consequences.

Root Cause

The root cause is lax input validation in Tornado's HTTP header parser. The parser accepts Content-Length values that deviate from RFC 7230, which mandates that the field contain only ASCII digits. By tolerating non-digit characters, Tornado computes a request body length that differs from what a strictly compliant proxy computes, enabling desynchronization.

Attack Vector

Exploitation requires the attacker to send crafted HTTP requests over the network to a Tornado application deployed behind a proxy. The attacker constructs a request with a malformed Content-Length header, for example one containing a + prefix, whitespace, or other non-digit characters that Tornado tolerates. The proxy forwards the request believing the body ends at one offset, while Tornado reads the body at a different offset and treats trailing bytes as the start of a new request. See the Tornado GitHub Security Advisory and the VulnCheck HTTP Request Smuggling Advisory for technical details.

Detection Methods for CVE-2023-54397

Indicators of Compromise

HTTP requests with Content-Length headers containing non-digit characters such as +, leading zeros with signs, or embedded whitespace
Proxy access logs showing request lengths that do not match downstream Tornado logs for the same connection
Unexpected responses served to users whose requests do not match the returned content, indicating queue poisoning
Cache entries containing responses to endpoints the requesting user did not access

Detection Strategies

Inspect ingress traffic for Content-Length header values that violate RFC 7230, which restricts the field to ASCII digits only
Correlate proxy and application logs on a per-connection basis to identify request count mismatches
Deploy Web Application Firewall rules that reject requests with duplicate or malformed Content-Length headers
Monitor for anomalous request pipelining patterns on keep-alive connections from single client IPs

Monitoring Recommendations

Alert on HTTP 400 spikes from upstream proxies, which may indicate smuggling probes being partially blocked
Log full raw request headers at the proxy boundary for forensic reconstruction
Track cache hit anomalies where cached content differs from expected responses for a given URL
Baseline normal request-per-connection distributions and flag outliers on shared front-end connections

How to Mitigate CVE-2023-54397

Immediate Actions Required

Upgrade Tornado to version 6.3.3 or later on all application servers
Audit all reverse proxies, load balancers, and CDNs in front of Tornado for strict Content-Length validation
Enable WAF signatures that block malformed Content-Length and Transfer-Encoding header combinations
Review recent proxy and application logs for indicators of prior smuggling attempts

Patch Information

The Tornado maintainers fixed this vulnerability in version 6.3.3 by tightening Content-Length parsing to accept only RFC-compliant digit sequences. Upgrade guidance is published in the Tornado GitHub Security Advisory GHSA-qppv-j76h-2rpx.

Workarounds

Place a strict RFC 7230-compliant reverse proxy in front of Tornado that rejects non-digit Content-Length values
Disable HTTP keep-alive on the proxy-to-Tornado connection to eliminate request queuing between tiers
Terminate all client connections at a hardened front-end that normalizes headers before forwarding
Enforce HTTP/2 end-to-end where possible, which uses length-prefixed framing instead of Content-Length parsing

bash

# Upgrade Tornado to the patched version
pip install --upgrade 'tornado>=6.3.3'

# Verify installed version
python -c "import tornado; print(tornado.version)"