{"id":"CVE-2024-58384","url":"https://www.cyber-defence.io/tools/cve/CVE-2024-58384","generatedAt":"2026-10-28T02:57:53.948Z","title":"Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers.","description":"Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.","published":"2026-09-15T16:17:07.000Z","lastModified":"2026-09-28T14:10:00.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":6.3,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-113"],"affected":[],"epss":{"score":0.00249,"percentile":0.16065,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-w235-7p84-xx57","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/tornado-before-6.4.1-crlf-injection-via-curlasynchttpclient","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-58384","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}