TO
Product
tornado
26
CVEs
0
On KEV
7.7
Max CVSS
6
New 30D
Severity mix
Critical 0High 12Medium 12Low 1
Watch
Add tornado to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-49853 | 7.7 | Jul 14 | Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient Affected: < 6.5.6 |
| CVE-2026-103262 | 7.5 | Oct 1 | Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient Affected: before 6.5.9 |
| CVE-2026-91990 | 7.5 | Sep 15 | Tornado before 6.5.8 Memory Amplification DoS via multipart Affected: before 6.5.8 |
| CVE-2024-14029 | 7.5 | Sep 15 | Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding Affected: before 6.4.1 |
| CVE-2023-54397 | 7.5 | Sep 15 | Tornado before 6.3.3 HTTP Request Smuggling via Content-Length Affected: before 6.3.3 |
| CVE-2026-82397 | 7.5 | Aug 31 | Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop Affected: < 6.5.8 |
| CVE-2026-49855 | 7.5 | Jul 14 | tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) Affected: < 6.5.6 |
| CVE-2026-31958 | 7.5 | Mar 11 | Tornado has a DoS due to too many multipart parts Affected: < 6.5.5 |
| CVE-2025-67726 | 7.5 | Dec 12 | Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters Affected: < 6.5.3 |
| CVE-2025-67725 | 7.5 | Dec 12 | Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing Affected: < 6.5.3 |
| CVE-2025-47287 | 7.5 | May 15 | Tornado is a Python web framework and asynchronous networking library Affected: before 6.5.0 |
| CVE-2024-52804 | 7.5 | Nov 22 | Tornado is a Python web framework and asynchronous networking library Affected: before 6.4.2 |
Showing 12