Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

tornado

26 known vulnerabilities (2 critical, 13 high, 8 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
6.6.0 (Oct 21, 2026): no advisory affects it
Newest unaffected release
6.6.0 (Oct 21, 2026), the latest release
Advisories
26 · 2 critical, 13 high, 8 medium, 1 low
Weekly downloads
29.3M
Dependents
14.7K
Releases
90 since 0.2.0 (May 18, 2010)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 26 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 26

  • Tornado: Open redirect in RedirectHandler via protocol-relative URLs

    Affected: fixed in 6.6.

    Fixed in 6.6.0 (released Oct 21, 2026, 5 days before disclosure).

    The latest release, 6.6.0, is not affected.

  • CVE-2026-116577Medium 5.3

    Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

    Affected: fixed in 6.6.

    Fixed in 6.6.0 (released Oct 21, 2026, 5 days before disclosure).

    The latest release, 6.6.0, is not affected.

  • CVE-2026-115927Medium 5.3

    Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

    Affected: fixed in 6.6.

    Fixed in 6.6.0 (released Oct 21, 2026, 5 days before disclosure).

    The latest release, 6.6.0, is not affected.

  • Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink

    Affected: fixed in 6.5.9.

    Fixed in 6.5.9 (released Sep 14, 2026, 17 days before disclosure).

    The latest release, 6.6.0, is not affected.

  • Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

    Affected: fixed in 6.5.9.

    Fixed in 6.5.9 (released Sep 14, 2026, 17 days before disclosure).

    The latest release, 6.6.0, is not affected.

  • CVE-2026-103261Medium 6.9

    Tornado before 6.5.9 Denial of Service via Query String

    Affected: fixed in 6.5.9.

    Fixed in 6.5.9 (released Sep 14, 2026, 17 days before disclosure).

    The latest release, 6.6.0, is not affected.

  • Tornado before 6.5.7 Credential Leak via Handle Reuse

    Affected: fixed in 6.5.7.

    Fixed in 6.5.7 (released Jun 8, 2026, 99 days before disclosure).

    The latest release, 6.6.0, is not affected.

  • CVE-2026-91991Medium 6.3

    Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs

    Affected: from 6.5.5, fixed in 6.5.8.

    Fixed in 6.5.8 (released Aug 7, 2026, 39 days before disclosure).

    The latest release, 6.6.0, is not affected.

  • Tornado before 6.5.8 Memory Amplification DoS via multipart

    Affected: fixed in 6.5.8.

    Fixed in 6.5.8 (released Aug 7, 2026, 39 days before disclosure).

    The latest release, 6.6.0, is not affected.

  • CVE-2024-58384Medium 6.3

    Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient

    Affected: fixed in 6.4.1.

    Fixed in 6.4.1 (released Jun 6, 2024, 831 days before disclosure).

    The latest release, 6.6.0, is not affected.

  • CVE-2024-14029Critical 9.0

    Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

    Affected: fixed in 6.4.1.

    Fixed in 6.4.1 (released Jun 6, 2024, 831 days before disclosure).

    The latest release, 6.6.0, is not affected.

  • CVE-2023-54397Critical 9.0

    Tornado before 6.3.3 HTTP Request Smuggling via Content-Length

    Affected: fixed in 6.3.3.

    Fixed in 6.3.3 (released Aug 11, 2023, 1131 days before disclosure).

    The latest release, 6.6.0, is not affected.

  • Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

    Affected: fixed in 6.5.8.

    Fixed in 6.5.8 (released Aug 7, 2026, 24 days before disclosure).

    The latest release, 6.6.0, is not affected.

  • tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

    Affected: fixed in 6.5.6.

    Fixed in 6.5.6 (released May 27, 2026, 48 days before disclosure).

    The latest release, 6.6.0, is not affected.

  • CVE-2026-49854Medium 5.3

    Tornado: Out-of-bounds memory access in C extension

    Affected: fixed in 6.5.6.

    Fixed in 6.5.6 (released May 27, 2026, 48 days before disclosure).

    The latest release, 6.6.0, is not affected.

Show all 26 advisoriesShow fewer advisories

  • Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

    Affected: fixed in 6.5.6.

    Fixed in 6.5.6 (released May 27, 2026, 48 days before disclosure).

    The latest release, 6.6.0, is not affected.

  • In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to…

    Affected: fixed in 6.5.5.

    Fixed in 6.5.5 (released Mar 10, 2026, 24 days before disclosure).

    The latest release, 6.6.0, is not affected.

  • Tornado has a DoS due to too many multipart parts

    Affected: fixed in 6.5.5.

    Fixed in 6.5.5 (released Mar 10, 2026, 1 day before disclosure).

    The latest release, 6.6.0, is not affected.

  • Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters

    Affected: fixed in 6.5.3.

    Fixed in 6.5.3 (released Dec 11, 2025, 1 day before disclosure).

    The latest release, 6.6.0, is not affected.

  • Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing

    Affected: fixed in 6.5.3.

    Fixed in 6.5.3 (released Dec 11, 2025, 1 day before disclosure).

    The latest release, 6.6.0, is not affected.

  • CVE-2025-67724Medium 5.4

    Tornado vulnerable to Header Injection and XSS via reason argument

    Affected: fixed in 6.5.3.

    Fixed in 6.5.3 (released Dec 11, 2025, 1 day before disclosure).

    The latest release, 6.6.0, is not affected.

  • Tornado vulnerable to excessive logging caused by malformed multipart form data

    Affected: fixed in 6.5.

    Fixed in 6.5.0 (released May 15, 2025, the day of disclosure).

    The latest release, 6.6.0, is not affected.

  • Tornado has HTTP cookie parsing DoS vulnerability

    Affected: fixed in 6.4.2.

    Fixed in 6.4.2 (released Nov 22, 2024, the day of disclosure).

    The latest release, 6.6.0, is not affected.

  • CVE-2023-28370Medium 6.1

    Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an…

    Affected: fixed in 6.3.2.

    Fixed in 6.3.2 (released May 14, 2023, 11 days before disclosure).

    The latest release, 6.6.0, is not affected.

  • Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it…

    Affected: fixed in 3.2.2; fixed in 3.2.2.

    Fixed in 3.2.2 (released Jun 4, 2014, 2060 days before disclosure).

    The latest release, 6.6.0, is not affected.

  • CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to…

    Affected: fixed in 2.2.1.

    Fixed in 2.2.1 (released May 22, 2014, 729 days after disclosure).

    The latest release, 6.6.0, is not affected.