{"action":"Upgrade tornado to 6.4.1 or later.","affected":[{"fixed":"6.4.1","introduced":"0"}],"component":"tornado","cve_ids":["CVE-2024-14029"],"ecosystem":"PyPI","epss":0.00361,"exploited":false,"fixed_versions":["6.4.1"],"ghsa_id":"GHSA-753j-mpmx-qq6g","id":"tcs_01M5KF4X54Q7V235VT9MG5BX16","modified_at":"2026-09-16T03:56:03.776164621Z","published_at":"2024-06-06T21:41:20Z","references":["https://osv.dev/vulnerability/GHSA-753j-mpmx-qq6g","https://github.com/tornadoweb/tornado/security/advisories/GHSA-753j-mpmx-qq6g","https://github.com/tornadoweb/tornado/commit/d65f6e71a77f53a1ff0a0dc55704be13f04eb572","https://github.com/tornadoweb/tornado"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-753j-mpmx-qq6g","url":"https://osv.dev/vulnerability/GHSA-753j-mpmx-qq6g"}],"summary":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado"}