python3-tornado vulnerabilities (Red Hat)

27 vulnerabilities.

• python3-tornado Red Hat Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient CVE-2026-103262 Fix available 8.7 HighSeptember 30, 2026
• python3-tornado Red Hat Tornado before 6.5.8 Memory Amplification DoS via multipart CVE-2026-91990 Fix available 8.7 HighSeptember 14, 2026
• python3-tornado Red Hat Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop CVE-2026-82397 Fix available 7.5 HighAugust 31, 2026
• python3-tornado Red Hat tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) CVE-2026-49855 Fix available 7.5 HighJune 13, 2026
• python3-tornado Red Hat Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient CVE-2026-49853 Fix available 7.7 HighJune 13, 2026
• python3-tornado Red Hat Tornado has incomplete validation of cookie attributes CVE-2026-35536 Fix available 7.2 HighMarch 11, 2026
• python3-tornado Red Hat Tornado has a DoS due to too many multipart parts CVE-2026-31958 Fix available 8.7 HighMarch 11, 2026
• python3-tornado Red Hat Tornado vulnerable to excessive logging caused by malformed multipart form data CVE-2025-47287 Fix available 7.5 HighMay 15, 2025
• python3-tornado Red Hat Tornado has HTTP cookie parsing DoS vulnerability CVE-2024-52804 Fix available 7.5 HighNovember 22, 2024
• python3-tornado Red Hat Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding CVE-2024-14029 Fix available 9.0 CriticalJune 6, 2024
• python3-tornado Red Hat Cri-o: security regression of cve-2022-27652 CVE-2022-3466 Fix available 4.8 MediumSeptember 15, 2023
• python3-tornado Red Hat Open redirect in Tornado CVE-2023-28370 Fix available 6.1 MediumMay 25, 2023
• python3-tornado Red Hat Unauthorized read of Custom Resources CVE-2022-3162 Fix available 6.5 MediumMarch 1, 2023
• python3-tornado Red Hat Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the... CVE-2022-3259 Fix available 7.4 HighDecember 9, 2022
• python3-tornado Red Hat Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF) CVE-2022-3172 Public exploitFix available 5.1 MediumOctober 14, 2022
• python3-tornado Red Hat Incorrect sanitization of forwarded query parameters in net/http/httputil CVE-2022-2880 Fix available 7.5 HighOctober 6, 2022
• python3-tornado Red Hat Memory exhaustion when compiling regular expressions in regexp/syntax CVE-2022-41715 Fix available 7.5 HighOctober 6, 2022
• python3-tornado Red Hat Unbounded memory consumption when reading headers in archive/tar CVE-2022-2879 Fix available 7.5 HighOctober 6, 2022
• python3-tornado Red Hat CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure CVE-2022-2995 Fix available 7.1 HighSeptember 19, 2022
• python3-tornado Red Hat Failure to strip relative path components in net/url CVE-2022-32190 Fix available 7.5 HighSeptember 12, 2022
• python3-tornado Red Hat golang.org/x/net/http2 Denial of Service vulnerability CVE-2022-27664 Fix available 7.5 HighSeptember 6, 2022
• python3-tornado Red Hat python-scciclient vulnerable to Man-in-the-middle (MITM) attacks CVE-2022-2996 Fix available 7.4 HighSeptember 1, 2022
• python3-tornado Red Hat Panic when decoding Float and Rat types in math/big CVE-2022-32189 Fix available 7.5 HighAugust 1, 2022
• python3-tornado Red Hat Exposure of client IP addresses in net/http CVE-2022-32148 Fix available 6.5 MediumJuly 16, 2022
• python3-tornado Red Hat Stack exhaustion when reading certain archives in compress/gzip CVE-2022-30631 Fix available 7.5 HighJuly 16, 2022
• python3-tornado Red Hat Improper sanitization of Transfer-Encoding headers in net/http CVE-2022-1705 Fix available 6.5 MediumJuly 16, 2022
• python3-tornado Red Hat Denial of service in gopkg.in/yaml.v2 CVE-2021-4235 Fix available 5.5 MediumApril 14, 2021