What is GHSA-qf37-5gqv-7f3m?

GHSA-qf37-5gqv-7f3m is a security advisory published by GitHub Security Advisories with Medium severity. Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to...

Which CVE IDs does GHSA-qf37-5gqv-7f3m cover?

GHSA-qf37-5gqv-7f3m covers the following CVE IDs: CVE-2024-58384. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qf37-5gqv-7f3m?

GHSA-qf37-5gqv-7f3m has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-qf37-5gqv-7f3mMediumCVSS 5.4

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to...

Vendor

GitHub Security Advisories

Published

September 15, 2026

Last Modified

September 15, 2026

🔗 CVE IDs covered (1)

CVE-2024-58384 →

📋 Description

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.

🔗 References (4)

https://github.com/tornadoweb/tornado/security/advisories/GHSA-w235-7p84-xx57
https://nvd.nist.gov/vuln/detail/CVE-2024-58384
https://www.vulncheck.com/advisories/tornado-before-6.4.1-crlf-injection-via-curlasynchttpclient
https://github.com/advisories/GHSA-qf37-5gqv-7f3m