TO
Product
tornado
26
CVEs
0
On KEV
7.7
Max CVSS
6
New 30D
Severity mix
Critical 0High 12Medium 12Low 1
Watch
Add tornado to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-49853 | 7.7 | Jul 14 | Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient Affected: < 6.5.6 |
| CVE-2026-103262 | 7.5 | Oct 1 | Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient Affected: before 6.5.9 |
| CVE-2026-91990 | 7.5 | Sep 15 | Tornado before 6.5.8 Memory Amplification DoS via multipart Affected: before 6.5.8 |
| CVE-2024-14029 | 7.5 | Sep 15 | Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding Affected: before 6.4.1 |
| CVE-2023-54397 | 7.5 | Sep 15 | Tornado before 6.3.3 HTTP Request Smuggling via Content-Length Affected: before 6.3.3 |
| CVE-2026-82397 | 7.5 | Aug 31 | Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop Affected: < 6.5.8 |
| CVE-2026-49855 | 7.5 | Jul 14 | tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) Affected: < 6.5.6 |
| CVE-2026-31958 | 7.5 | Mar 11 | Tornado has a DoS due to too many multipart parts Affected: < 6.5.5 |
| CVE-2025-67726 | 7.5 | Dec 12 | Tornado is a Python web framework and asynchronous networking library Affected: before 6.5.3 |
| CVE-2025-67725 | 7.5 | Dec 12 | Tornado is a Python web framework and asynchronous networking library Affected: before 6.5.3 |
| CVE-2025-47287 | 7.5 | May 15 | Tornado is a Python web framework and asynchronous networking library Affected: before 6.5.0 |
| CVE-2024-52804 | 7.5 | Nov 22 | Tornado is a Python web framework and asynchronous networking library Affected: before 6.4.2 |
| CVE-2014-9720 | 6.5 | Jan 24 | Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a… Affected: before 3.2.2 |
| CVE-2025-67724 | 6.1 | Dec 12 | Tornado is a Python web framework and asynchronous networking library Affected: before 6.5.3 |
| CVE-2023-28370 | 6.1 | May 25 | Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing… Affected: before 6.3.2 |
| CVE-2026-103263 | 5.9 | Oct 1 | Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink Affected: before 6.5.9 |
| CVE-2026-91992 | 5.9 | Sep 15 | Tornado before 6.5.7 Credential Leak via Handle Reuse Affected: before 6.5.7 |
| CVE-2026-91991 | 5.4 | Sep 15 | Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs Affected: 6.5.5 before 6.5.8 |
| CVE-2024-58384 | 5.4 | Sep 15 | Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient Affected: before 6.4.1 |
| CVE-2026-116577 New | 5.3 | Oct 26 | Tornado: Quadratic CPU usage when parsing HTTP headers with line folding Affected: < 6.6 |
| CVE-2026-115927 New | 5.3 | Oct 26 | Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks Affected: < 6.6.0 |
| CVE-2026-103261 | 5.3 | Oct 1 | Tornado before 6.5.9 Denial of Service via Query String Affected: before 6.5.9 |
| CVE-2026-49854 | 5.3 | Jul 14 | Tornado: Out-of-bounds memory access in C extension Affected: < 6.5.6 |
| CVE-2026-35536 | 5.3 | Apr 3 | In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted… Affected: before 6.5.5 |
| CVE-2026-116578 New | 2.1 | Oct 26 | Tornado: Open redirect in RedirectHandler via protocol-relative URLs Affected: < 6.6 |
| CVE-2012-2374 | – | May 23 | CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct… Affected: through 2.2; 1.0; 1.0.1; 1.1; 1.1.1; 1.2; +4 more |
Showing 26