Unscored severity · published May 23, 2012
CVE-2012-2374
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct…
–
CVSS
1.4%
EPSS
No
On KEV
Description
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
Tornado · Tornadoweb
through 2.2; 1.0; 1.0.1; 1.1; 1.1.1; 1.2; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2374
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2374
openwall.com
http://openwall.com/lists/oss-security/2012/05/18/12
secunia.com
http://secunia.com/advisories/49185
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/05/18/6
www.securityfocus.com
http://www.securityfocus.com/bid/53612
Vendor Advisory
http://www.tornadoweb.org/documentation/releases/v2.2.1.html
More from Tornado
7.7
CVE-2026-49853
Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
7.5
CVE-2026-103262
Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient
7.5
CVE-2026-91990
Tornado before 6.5.8 Memory Amplification DoS via multipart
7.5
CVE-2024-14029
Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
7.5
CVE-2023-54397
Tornado before 6.3.3 HTTP Request Smuggling via Content-Length