Patch Forecast
Amber warning
Patch this week.

CVE-2023-54397

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of…

Risk score
61/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.4%
Published
15 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.
Affected
Canonical Ubuntu Linux before 6.3.3
Fix
Upgrade Canonical Ubuntu Linux to 6.3.3 or later.
Exploitation
No known exploitation

Story map

Story map: Canonical Ubuntu LinuxTHE FLAWSTHE FIXCVE-2023-54397Tornado before 6.3.3 containsan HTTP request smugglingvulnerability due to improper…CVSS 7.5 · EPSS 0%CVE-2026-74221Denial of serviceCVSS 8.2 · EPSS 0%CVE-2026-74220Denial of serviceCVSS 8.2 · EPSS 0%CVE-2026-103262Denial of serviceCVSS 7.5 · EPSS 1%Upgrade Canonical Ubuntu…6.3.3 · 2026.10 · 6.5.9or later on your release lineWho is exposedCanonical Ubuntu Linux before2026.10AMBER · PATCH THIS WEEKCanonical UbuntuLinuxU-Boot before 2026.10-rc5contains a buffer overflow innfs_readlink_reply() function innet/nfs-common.c whenprocessing NFS serverresponses. A malicious NFSserver can send crafted…Where it standsNo known exploitationHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.21 Oct · Ubuntu security noticesUSN-8930-2: U-Boot vulnerabilities22 Oct · Ubuntu security noticesUSN-8952-1: Tornado vulnerabilitiesCONNECTS TOSame weaknessCWE-444 (CWE-444)28 other warnings in 30 days →Same productEarlier Canonical Ubuntu Linux warnings15 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Canonical Ubuntu Linux: Amber, patch this week. U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.

The flaws

  • CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of… (CVSS 7.5 · EPSS 0%)
  • CVE-2026-74221: Denial of service (CVSS 8.2 · EPSS 0%)
  • CVE-2026-74220: Denial of service (CVSS 8.2 · EPSS 0%)
  • CVE-2026-103262: Denial of service (CVSS 7.5 · EPSS 1%)

The fix

Upgrade Canonical Ubuntu Linux: 6.3.3 · 2026.10 · 6.5.9 or later on your release line

Who is exposed: Canonical Ubuntu Linux before 2026.10

Where it stands

  • No known exploitation

How it unfolded

  1. 21 Oct, Ubuntu security notices (official): USN-8930-2: U-Boot vulnerabilities
  2. 22 Oct, Ubuntu security notices (official): USN-8952-1: Tornado vulnerabilities

Connects to

Why it is Amber

  • CVSS 7.5 high
  • Remotely exploitable without logging in
  • Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.

Last activity 22 Oct 2026. Patch Forecast updates every hour.