Tornado CRLF injection vulnerability

MEDIUM 5.0CVE-2012-2374 · GHSA-f7fv-v9rh-prvc · PYSEC-2012-5 · Published 23/05/2012 · updated 16/06/2026

In short

CVE-2012-2374 is a MEDIUM (CVSS 5.0) vulnerability affecting tornado, tornado (tornadoweb).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 71.7% of all vulnerabilities.
Fix: update to 2.2.1 or later.

Package	Affected versions	Patched versions
tornado PyPI	`< 2.2.1`	`2.2.1`
tornado tornadoweb	`= 1.0= 1.0.1= 1.1= 1.1.1= 1.2= 1.2.1= 2.0= 2.1= 2.1.1≤ 2.2`	No fix yet

Description

CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.

NVD description

CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.