Tornadoweb Tornado vulnerabilities

• tornadoweb tornado Tornado before 6.6 Cookie Attribute Injection via set_cookie max_age CVE-2026-123535 2.3 LowNovember 8, 2026
• tornadoweb tornado Tornado before 6.6 Path Traversal via static_url() Version Hashing CVE-2026-123534 8.3 HighNovember 8, 2026
• tornadoweb tornado Tornado: Open redirect in RedirectHandler via protocol-relative URLs CVE-2026-116578 Fix available 2.1 LowOctober 26, 2026
• tornadoweb tornado Tornado: Quadratic CPU usage when parsing HTTP headers with line folding CVE-2026-116577 Fix available 5.3 MediumOctober 26, 2026
• tornadoweb tornado Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks CVE-2026-115927 Fix available 5.3 MediumOctober 26, 2026
• tornadoweb tornado Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink CVE-2026-103263 Fix available 8.2 HighOctober 1, 2026
• tornadoweb tornado Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient CVE-2026-103262 Fix available 8.7 HighSeptember 30, 2026
• tornadoweb tornado Tornado before 6.5.9 Denial of Service via Query String CVE-2026-103261 Fix available 6.9 MediumSeptember 30, 2026
• tornadoweb tornado Tornado before 6.5.8 Memory Amplification DoS via multipart CVE-2026-91990 Fix available 8.7 HighSeptember 14, 2026
• tornadoweb tornado Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs CVE-2026-91991 Fix available 6.3 MediumSeptember 1, 2026
• tornadoweb tornado Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop CVE-2026-82397 Fix available 7.5 HighAugust 31, 2026
• tornadoweb tornado Tornado before 6.5.7 Credential Leak via Handle Reuse CVE-2026-91992 Fix available 8.2 HighJune 15, 2026
• tornadoweb tornado tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) CVE-2026-49855 Fix available 7.5 HighJune 13, 2026
• tornadoweb tornado Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient CVE-2026-49853 Fix available 7.7 HighJune 13, 2026
• tornadoweb tornado Tornado: Out-of-bounds memory access in C extension CVE-2026-49854 Fix available 5.3 MediumJune 12, 2026
• tornadoweb tornado Tornado has incomplete validation of cookie attributes CVE-2026-35536 Fix available 7.2 HighMarch 11, 2026
• tornadoweb tornado Tornado has a DoS due to too many multipart parts CVE-2026-31958 Fix available 8.7 HighMarch 11, 2026
• tornadoweb tornado Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters CVE-2025-67726 Fix available 7.5 HighDecember 12, 2025
• tornadoweb tornado Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing CVE-2025-67725 Fix available 7.5 HighDecember 12, 2025
• tornadoweb tornado Tornado vulnerable to Header Injection and XSS via reason argument CVE-2025-67724 Fix available 5.4 MediumDecember 12, 2025
• tornadoweb tornado, debian linux +1 more Tornado vulnerable to excessive logging caused by malformed multipart form data CVE-2025-47287 Fix available 7.5 HighMay 15, 2025
• tornadoweb tornado Tornado has HTTP cookie parsing DoS vulnerability CVE-2024-52804 Fix available 7.5 HighNovember 22, 2024
• tornadoweb tornado Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient CVE-2024-58384 Fix available 6.3 MediumJune 6, 2024
• tornadoweb tornado Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding CVE-2024-14029 Fix available 9.0 CriticalJune 6, 2024
• tornadoweb tornado Tornado before 6.3.3 HTTP Request Smuggling via Content-Length CVE-2023-54397 Fix available 9.0 CriticalAugust 14, 2023
• tornadoweb tornado Open redirect in Tornado CVE-2023-28370 Fix available 6.1 MediumMay 25, 2023
• tornadoweb tornado Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack) CVE-2014-9720 Fix available 6.5 MediumJuly 1, 2015
• tornadoweb tornado Tornado CRLF injection vulnerability CVE-2012-2374 Fix available 5.0 MediumMay 23, 2012