is_transfer_encoding_chunked(headers: HTTPHeaders) → bool Returns true if the headers specify Transfer-Encoding: chunked. Raise httputil.HTTPInputError if any other transfer encoding is used. 6.4 Asynchronous Tornado 6.4.1 Jun 6, 2024 Security Improvements • Parsing of the Transfer-Encoding header is now stricter. Unexpected transfer-encoding values were previously ignored and treated as the HTTP/1.0 default Tornado 6.3.3 Aug 11, 2023 Security improvements • The Content-Length header and chunked Transfer-Encoding sizes are now parsed more strictly (according to the relevant RFCs) to avoid potential request-smuggling

now responds with a 400 error instead of simply closing the connection. Content-Length and Transfer-Encoding headers are no longer sent with 1xx or 204 responses (this was already true of 304 responses) curl_httpclient Improved debug logging on Python 3. tornado.httpserver Content-Length and Transfer-Encoding headers are no longer sent with 1xx or 204 responses (this was already true of 304 responses) is_coroutine_function identifies functions wrapped by coroutine or engine. tornado.http1connection The Transfer-Encoding header is now parsed case-insensitively. tornado.httpclient SimpleAsyncHTTPClient now follows

now responds with a 400 error instead of simply closing the connection. Content-Length and Transfer-Encoding headers are no longer sent with 1xx or 204 responses (this was already true of 304 responses) curl_httpclient Improved debug logging on Python 3. tornado.httpserver Content-Length and Transfer-Encoding headers are no longer sent with 1xx or 204 responses (this was already true of 304 responses) is_coroutine_function identifies functions wrapped by coroutine or engine. tornado.http1connection The Transfer-Encoding header is now parsed case-insensitively. tornado.httpclient SimpleAsyncHTTPClient now follows

[https://docs.python.org/3/library/functions.html#bool] Returns true if the headers specify Transfer-Encoding: chunked. Raise httputil.HTTPInputError if any other transfer encoding is used.Asynchronous CVE-2024-7592.What’s new in Tornado 6.4.1 Jun 6, 2024 Security Improvements Parsing of the Transfer-Encoding header is now stricter. Unexpected transfer- encoding values were previously ignored and treated in Tornado 6.3.3 Aug 11, 2023 Security improvements The Content-Length header and chunked Transfer-Encoding sizes are now parsed more strictly (according to the relevant RFCs) to avoid potential request-

Tornado 6.3.3 Aug 11, 2023 Security improvements • The Content-Length header and chunked Transfer-Encoding sizes are now parsed more strictly (according to the relevant RFCs) to avoid potential request-smuggling now responds with a 400 error instead of simply closing the connection. • Content-Length and Transfer-Encoding headers are no longer sent with 1xx or 204 responses (this was already true of 304 responses) curl_httpclient • Improved debug logging on Python 3. tornado.httpserver • Content-Length and Transfer-Encoding headers are no longer sent with 1xx or 204 responses (this was already true of 304 responses)

Tornado 6.3.3 Aug 11, 2023 Security improvements • The Content-Length header and chunked Transfer-Encoding sizes are now parsed more strictly (according to the relevant RFCs) to avoid potential request-smuggling now responds with a 400 error instead of simply closing the connection. • Content-Length and Transfer-Encoding headers are no longer sent with 1xx or 204 responses (this was already true of 304 responses) curl_httpclient • Improved debug logging on Python 3. tornado.httpserver • Content-Length and Transfer-Encoding headers are no longer sent with 1xx or 204 responses (this was already true of 304 responses)

Tornado 6.3.3 Aug 11, 2023 Security improvements • The Content-Length header and chunked Transfer-Encoding sizes are now parsed more strictly (according to the relevant RFCs) to avoid potential request-smuggling now responds with a 400 error instead of simply closing the connection. • Content-Length and Transfer-Encoding headers are no longer sent with 1xx or 204 responses (this was already true of 304 responses) curl_httpclient • Improved debug logging on Python 3. tornado.httpserver • Content-Length and Transfer-Encoding headers are no longer sent with 1xx or 204 responses (this was already true of 304 responses)

Tornado 6.3.3 Aug 11, 2023 Security improvements • The Content-Length header and chunked Transfer-Encoding sizes are now parsed more strictly (according to the relevant RFCs) to avoid potential request-smuggling now responds with a 400 error instead of simply closing the connection. • Content-Length and Transfer-Encoding headers are no longer sent with 1xx or 204 responses (this was already true of 304 responses) curl_httpclient • Improved debug logging on Python 3. tornado.httpserver • Content-Length and Transfer-Encoding headers are no longer sent with 1xx or 204 responses (this was already true of 304 responses)

now responds with a 400 error instead of simply closing the connection. • Content-Length and Transfer-Encoding headers are no longer sent with 1xx or 204 responses (this was already true of 304 responses) curl_httpclient • Improved debug logging on Python 3. tornado.httpserver • Content-Length and Transfer-Encoding headers are no longer sent with 1xx or 204 responses (this was already true of 304 responses) is_coroutine_function identifies functions wrapped by coroutine or engine. tornado.http1connection • The Transfer-Encoding header is now parsed case-insensitively. tornado.httpclient • SimpleAsyncHTTPClient now follows

now responds with a 400 error instead of simply closing the connection. • Content-Length and Transfer-Encoding headers are no longer sent with 1xx or 204 responses (this was already true of 304 responses) curl_httpclient • Improved debug logging on Python 3. tornado.httpserver • Content-Length and Transfer-Encoding headers are no longer sent with 1xx or 204 responses (this was already true of 304 responses) is_coroutine_function identifies functions wrapped by coroutine or engine. tornado.http1connection • The Transfer-Encoding header is now parsed case-insensitively. tornado.httpclient • SimpleAsyncHTTPClient now follows