Patch Forecast
Amber warning
Patch this week.

CVE-2024-14029

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as…

Risk score
61/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.4%
Published
15 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass…
Affected
Canonical Ubuntu Linux before 6.4.1
Fix
Upgrade Canonical Ubuntu Linux to 6.4.1 or later.
Exploitation
No known exploitation

Story map

Story map: Canonical Ubuntu LinuxTHE FLAWSTHE FIXCVE-2024-14029Tornado before 6.4.1 ignoresduplicate Transfer-Encoding:chunked headers, treating…CVSS 7.5 · EPSS 0%CVE-2026-74221Denial of serviceCVSS 8.2 · EPSS 0%CVE-2026-74220Denial of serviceCVSS 8.2 · EPSS 0%CVE-2026-103262Denial of serviceCVSS 7.5 · EPSS 1%Upgrade Canonical Ubuntu…6.4.1 · 2026.10 · 6.5.9or later on your release lineWho is exposedCanonical Ubuntu Linux before2026.10AMBER · PATCH THIS WEEKCanonical UbuntuLinuxU-Boot before 2026.10-rc5contains a buffer overflow innfs_readlink_reply() function innet/nfs-common.c whenprocessing NFS serverresponses. A malicious NFSserver can send crafted…Where it standsNo known exploitationHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.21 Oct · Ubuntu security noticesUSN-8930-2: U-Boot vulnerabilities22 Oct · Ubuntu security noticesUSN-8952-1: Tornado vulnerabilitiesCONNECTS TOSame weaknessCWE-444 (CWE-444)28 other warnings in 30 days →Same productEarlier Canonical Ubuntu Linux warnings15 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Canonical Ubuntu Linux: Amber, patch this week. U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.

The flaws

  • CVE-2024-14029: Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as… (CVSS 7.5 · EPSS 0%)
  • CVE-2026-74221: Denial of service (CVSS 8.2 · EPSS 0%)
  • CVE-2026-74220: Denial of service (CVSS 8.2 · EPSS 0%)
  • CVE-2026-103262: Denial of service (CVSS 7.5 · EPSS 1%)

The fix

Upgrade Canonical Ubuntu Linux: 6.4.1 · 2026.10 · 6.5.9 or later on your release line

Who is exposed: Canonical Ubuntu Linux before 2026.10

Where it stands

  • No known exploitation

How it unfolded

  1. 21 Oct, Ubuntu security notices (official): USN-8930-2: U-Boot vulnerabilities
  2. 22 Oct, Ubuntu security notices (official): USN-8952-1: Tornado vulnerabilities

Connects to

Why it is Amber

  • CVSS 7.5 high
  • Remotely exploitable without logging in
  • Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.

Last activity 22 Oct 2026. Patch Forecast updates every hour.