CVE-2012-2374: CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1...

Security readout for executives and security teams

This flaw affects older Tornado web applications. If an application placed attacker-controlled text into HTTP response headers, an attacker could add extra headers or split a response. Business impact depends on how the application used headers, but the issue can support cache, redirect, or session-handling abuse. Exposure is likely limited to systems running Tornado before 2.2.1, especially applications that call set_header with values influenced by request parameters, stored user content, or upstream data. The provided affected-product metadata is incomplete, so inventory confirmation is required. Address during routine vulnerability remediation, with higher priority for public-facing services or login, redirect, cookie, and cache-sensitive workflows. There is no sourced evidence of active exploitation in the provided bundle, but vulnerable patterns can create meaningful web security risk. Mitigation focus: Upgrade Tornado to 2.2.1 or later where feasible.; Review vendor release notes and package guidance for supported upgrade paths.; Avoid placing untrusted data directly into response headers..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.