Tornadoweb / Tornado
23 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-103263 | Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink | HIGH | 8.2 | Oct 1, 2026 |
| CVE-2026-103262 | Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient | HIGH | 8.7 | Oct 1, 2026 |
| CVE-2026-103261 | Tornado before 6.5.9 Denial of Service via Query String | MEDIUM | 6.9 | Oct 1, 2026 |
| CVE-2026-91992 | Tornado before 6.5.7 Credential Leak via Handle Reuse | HIGH | 8.2 | Sep 15, 2026 |
| CVE-2026-91991 | Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs | MEDIUM | 6.3 | Sep 15, 2026 |
| CVE-2026-91990 | Tornado before 6.5.8 Memory Amplification DoS via multipart | HIGH | 8.7 | Sep 15, 2026 |
| CVE-2024-58384 | Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient | MEDIUM | 6.3 | Sep 15, 2026 |
| CVE-2024-14029 | Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding | CRITICAL | 9.0 | Sep 15, 2026 |
| CVE-2023-54397 | Tornado before 6.3.3 HTTP Request Smuggling via Content-Length | CRITICAL | 9.0 | Sep 15, 2026 |
| CVE-2026-82397 | Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop | HIGH | 7.5 | Aug 31, 2026 |
| CVE-2026-49855 | tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) | HIGH | 7.5 | Jul 14, 2026 |
| CVE-2026-49854 | Tornado: Out-of-bounds memory access in C extension | MEDIUM | 5.3 | Jul 14, 2026 |
| CVE-2026-49853 | Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient | HIGH | 7.7 | Jul 14, 2026 |
| CVE-2026-35536 | tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments | HIGH | 7.2 | Apr 3, 2026 |
| CVE-2026-31958 | Tornado has a DoS due to too many multipart parts | HIGH | 8.7 | Mar 11, 2026 |
| CVE-2025-67726 | Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters | HIGH | 7.5 | Dec 12, 2025 |
| CVE-2025-67725 | Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing | HIGH | 7.5 | Dec 12, 2025 |
| CVE-2025-67724 | Tornado vulnerable to Header Injection and XSS via reason argument | MEDIUM | 6.1 | Dec 12, 2025 |
| CVE-2025-47287 | Tornado vulnerable to excessive logging caused by malformed multipart form data | HIGH | 7.5 | May 15, 2025 |
| CVE-2024-52804 | Tornado has HTTP cookie parsing DoS vulnerability | HIGH | 7.5 | Nov 22, 2024 |
| CVE-2023-28370 | python-tornado: open redirect vulnerability in StaticFileHandler under certain configurations | MEDIUM | 5.3 | May 25, 2023 |
| CVE-2014-9720 | python-tornado: XSRF cookie allows side-channel attack against TLS (BREACH) | HIGH | 7.1 | Jan 24, 2020 |
| CVE-2012-2374 | CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP hea… | HIGH | 8.7 | May 23, 2012 |
Showing 1 to 23 of 23 CVEs