{"action":"Upgrade tornado to 6.3.3 or later.","affected":[{"fixed":"6.3.3","introduced":"0"}],"component":"tornado","cve_ids":["CVE-2023-54397"],"ecosystem":"PyPI","epss":0.00377,"exploited":false,"fixed_versions":["6.3.3"],"ghsa_id":"GHSA-qppv-j76h-2rpx","id":"tcs_01M5KFWF1D1ZJ5TTEEAZZ28Q6A","modified_at":"2026-09-16T03:56:01.387511075Z","published_at":"2023-08-14T21:34:17Z","references":["https://osv.dev/vulnerability/GHSA-qppv-j76h-2rpx","https://github.com/tornadoweb/tornado/security/advisories/GHSA-qppv-j76h-2rpx","https://github.com/tornadoweb/tornado/commit/b7a5dd29bb02950303ae96055082c12a1ea0a4fe","https://github.com/tornadoweb/tornado"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-qppv-j76h-2rpx","url":"https://osv.dev/vulnerability/GHSA-qppv-j76h-2rpx"}],"summary":"Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths"}