CVE-2024-58384 Overview
CVE-2024-58384 is a Carriage Return Line Feed (CRLF) injection vulnerability in the Tornado Python web framework. The flaw resides in CurlAsyncHTTPClient, which fails to reject carriage return (\r) and line feed (\n) characters in outbound HTTP request header values. Attackers who control header values passed to the client can inject additional headers or smuggle entirely new HTTP requests to backend services. The vulnerability affects Tornado versions prior to 6.4.1 and is tracked under CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers.
Critical Impact
An attacker able to influence outbound header values can inject arbitrary HTTP headers or forge new requests, enabling HTTP request smuggling and response splitting against upstream services.
Affected Products
- Tornado web framework versions prior to 6.4.1
- Applications using tornado.curl_httpclient.CurlAsyncHTTPClient
- Python services that pass untrusted input into outbound HTTP headers via Tornado's cURL-based async client
Discovery Timeline
- 2026-09-15 - CVE-2024-58384 published to the National Vulnerability Database (NVD)
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2024-58384
Vulnerability Analysis
Tornado's CurlAsyncHTTPClient builds outbound HTTP requests using libcurl bindings. Before version 6.4.1, the client did not validate header values for embedded CRLF characters before passing them to libcurl. HTTP headers are delimited by \r\n sequences, and the message body is separated from headers by an empty line (\r\n\r\n). Injecting these sequences into a header value therefore lets an attacker terminate the current header, insert new headers, or terminate the header block entirely and inject a request body.
The issue matters most in applications that forward user-supplied data into headers such as User-Agent, X-Forwarded-For, Authorization, or custom API tokens. In proxy and integration scenarios, the injected content is interpreted by the upstream server, not the Tornado process itself.
Root Cause
The root cause is missing input validation on header values passed to CurlAsyncHTTPClient. The standard SimpleAsyncHTTPClient in Tornado had rejected such characters, but the cURL-based client lacked equivalent checks. The fix in Tornado 6.4.1 enforces validation that rejects \r and \n in header names and values before they reach libcurl.
Attack Vector
Exploitation requires an attacker to control the value of an HTTP request header sent by a Tornado-based client. A typical attack pattern involves supplying a value containing \r\nInjected-Header: value or \r\n\r\n<smuggled request>. The upstream server parses the injected bytes as legitimate protocol data, resulting in header injection, cache poisoning, or HTTP request smuggling against the backend.
Refer to the GitHub Security Advisory GHSA-w235-7p84-xx57 and the VulnCheck Advisory for Tornado CRLF Injection for full technical details. No public proof-of-concept exploit code has been verified for this CVE.
Detection Methods for CVE-2024-58384
Indicators of Compromise
- Outbound HTTP requests from Tornado services containing raw \r\n bytes inside header values captured in network traces
- Application or proxy logs recording unexpected headers, duplicate Host headers, or unusual Content-Length and Transfer-Encoding combinations
- Upstream web server logs showing requests that appear to originate mid-stream or contain smuggled second requests
Detection Strategies
- Inventory Python dependencies and flag any Tornado installation earlier than 6.4.1 in software composition analysis (SCA) tooling
- Add static analysis rules that identify code paths passing untrusted input into HTTPRequest headers or curl_httpclient calls without sanitization
- Inspect egress traffic at a web proxy for CRLF byte sequences (%0d%0a, \r\n) embedded in header fields
Monitoring Recommendations
- Enable verbose logging on outbound HTTP clients and forward logs to a centralized analytics platform for anomaly detection
- Alert on Tornado application errors referencing header parsing or libcurl CURLE_* codes that may signal exploitation attempts
- Correlate application telemetry with upstream service logs to detect smuggled requests that bypass front-end controls
How to Mitigate CVE-2024-58384
Immediate Actions Required
- Upgrade Tornado to version 6.4.1 or later across all Python services and container images
- Audit application code for user-controlled input flowing into HTTP request headers via CurlAsyncHTTPClient
- Rebuild and redeploy any downstream artifacts (Docker images, wheels, virtual environments) that bundled a vulnerable Tornado release
Patch Information
The vulnerability is fixed in Tornado 6.4.1. The maintainers added validation in CurlAsyncHTTPClient that rejects header names and values containing CR or LF characters, matching the behavior of SimpleAsyncHTTPClient. Upgrade guidance and patch details are available in the GitHub Security Advisory GHSA-w235-7p84-xx57.
Workarounds
- Switch from CurlAsyncHTTPClient to SimpleAsyncHTTPClient where feasible, since the simple client already rejects CRLF in headers
- Sanitize all header values before assignment by stripping or rejecting \r and \n characters in application code
- Place an egress proxy in front of Tornado services that normalizes HTTP headers and blocks requests containing raw CRLF sequences
# Upgrade Tornado to the patched release
pip install --upgrade 'tornado>=6.4.1'
# Verify the installed version
python -c "import tornado; print(tornado.version)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
