VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Sep 15, 2026· Updated Sep 28, 2026

CVE-2024-58384

CVE-2024-58384

Description

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Tornadoweb/Tornadoinferred2 versions
    <6.4.1+ 1 more
    • (no CPE)range: <6.4.1
    • (no CPE)range: <6.4.1

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.