Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a…

Tornado is a Python web framework and asynchronous networking library

Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing…

Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink

Tornado before 6.5.7 Credential Leak via Handle Reuse

Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs

Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient

Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

Tornado before 6.5.9 Denial of Service via Query String

Tornado: Out-of-bounds memory access in C extension

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted…