TO
Vendor
tornadoweb
26
CVEs
0
On KEV
6
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116578 New | TO tornado tornadoweb | 2.1 | Oct 26 | Tornado: Open redirect in RedirectHandler via protocol-relative URLs |
| CVE-2026-116577 New | TO tornado tornadoweb | 5.3 | Oct 26 | Tornado: Quadratic CPU usage when parsing HTTP headers with line folding |
| CVE-2026-115927 New | TO tornado tornadoweb | 5.3 | Oct 26 | Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks |
| CVE-2026-103263 | TO tornado tornadoweb | 5.9 | Oct 1 | Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink |
| CVE-2026-103262 | TO tornado tornadoweb | 7.5 | Oct 1 | Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient |
| CVE-2026-103261 | TO tornado tornadoweb | 5.3 | Oct 1 | Tornado before 6.5.9 Denial of Service via Query String |
| CVE-2026-91992 | TO tornado tornadoweb | 5.9 | Sep 15 | Tornado before 6.5.7 Credential Leak via Handle Reuse |
| CVE-2026-91991 | TO tornado tornadoweb | 5.4 | Sep 15 | Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs |
| CVE-2026-91990 | TO tornado tornadoweb | 7.5 | Sep 15 | Tornado before 6.5.8 Memory Amplification DoS via multipart |
| CVE-2024-58384 | TO tornado tornadoweb | 5.4 | Sep 15 | Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient |
| CVE-2024-14029 | TO tornado tornadoweb | 7.5 | Sep 15 | Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding |
| CVE-2023-54397 | TO tornado tornadoweb | 7.5 | Sep 15 | Tornado before 6.3.3 HTTP Request Smuggling via Content-Length |
| CVE-2026-82397 | TO tornado tornadoweb | 7.5 | Aug 31 | Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop |
| CVE-2026-49855 | TO tornado tornadoweb | 7.5 | Jul 14 | tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) |
| CVE-2026-49854 | TO tornado tornadoweb | 5.3 | Jul 14 | Tornado: Out-of-bounds memory access in C extension |
| CVE-2026-49853 | TO tornado tornadoweb | 7.7 | Jul 14 | Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient |
| CVE-2026-35536 | TO Tornado tornadoweb | 5.3 | Apr 3 | In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted… |
| CVE-2026-31958 | TO tornado tornadoweb | 7.5 | Mar 11 | Tornado has a DoS due to too many multipart parts |
| CVE-2025-67726 | TO Tornado Tornadoweb | 7.5 | Dec 12 | Tornado is a Python web framework and asynchronous networking library |
| CVE-2025-67725 | TO Tornado Tornadoweb | 7.5 | Dec 12 | Tornado is a Python web framework and asynchronous networking library |
| CVE-2025-67724 | TO Tornado Tornadoweb | 6.1 | Dec 12 | Tornado is a Python web framework and asynchronous networking library |
| CVE-2025-47287 | TO Tornado Tornadoweb | 7.5 | May 15 | Tornado is a Python web framework and asynchronous networking library |
| CVE-2024-52804 | TO Tornado Tornadoweb | 7.5 | Nov 22 | Tornado is a Python web framework and asynchronous networking library |
| CVE-2023-28370 | TO Tornado Tornadoweb | 6.1 | May 25 | Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing… |
| CVE-2014-9720 | TO Tornado Tornadoweb | 6.5 | Jan 24 | Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a… |
| CVE-2012-2374 | TO Tornado Tornadoweb | – | May 23 | CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct… |