Request Smuggling

tornado is vulnerable to Request Smuggling. This vulnerability is due to mishandling multiple Transfer-Encoding: chunked headers, which allows for request smuggling attacks when deployed behind a proxy server that emits such requests.