# tornado (PyPI) vulnerabilities 26 known vulnerabilities (2 critical, 13 high, 8 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 6.6.0 (Oct 21, 2026): no advisory affects it - Newest unaffected release: 6.6.0 (Oct 21, 2026), the latest release - Weekly downloads: 29.3M - Dependents: 14.7K - Releases: 90 since 0.2.0 (May 18, 2010) - Registry: https://pypi.org/project/tornado/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-116578: 0.2.0 to 6.6.0rc1 (6.6.0 is outside it) - CVE-2026-116577: 0.2.0 to 6.6.0rc1 (6.6.0 is outside it) - CVE-2026-115927: 0.2.0 to 6.6.0rc1 (6.6.0 is outside it) - CVE-2026-103263: 0.2.0 to 6.5.8 (6.5.9 is outside it) - CVE-2026-103262: 0.2.0 to 6.5.8 (6.5.9 is outside it) - CVE-2026-103261: 0.2.0 to 6.5.8 (6.5.9 is outside it) - CVE-2026-91992: 0.2.0 to 6.5.6 (6.5.7 is outside it) - CVE-2026-91991: 6.5.5 to 6.5.7 (6.5.8 is outside it) - CVE-2026-91990: 0.2.0 to 6.5.7 (6.5.8 is outside it) - CVE-2024-58384: 0.2.0 to 6.4.0 (6.4.1 is outside it) - CVE-2024-14029: 0.2.0 to 6.4.0 (6.4.1 is outside it) - CVE-2023-54397: 0.2.0 to 6.3.2 (6.3.3 is outside it) - CVE-2026-82397: 0.2.0 to 6.5.7 (6.5.8 is outside it) - CVE-2026-49855: 0.2.0 to 6.5.5 (6.5.6 is outside it) - CVE-2026-49854: 0.2.0 to 6.5.5 (6.5.6 is outside it) - CVE-2026-49853: 0.2.0 to 6.5.5 (6.5.6 is outside it) - CVE-2026-35536: 0.2.0 to 6.5.4 (6.5.5 is outside it) - CVE-2026-31958: 0.2.0 to 6.5.4 (6.5.5 is outside it) - CVE-2025-67726: 0.2.0 to 6.5.2 (6.5.3 is outside it) - CVE-2025-67725: 0.2.0 to 6.5.2 (6.5.3 is outside it) - CVE-2025-67724: 0.2.0 to 6.5.2 (6.5.3 is outside it) - CVE-2025-47287: 0.2.0 to 6.5.0b1 (6.5.0 is outside it) - CVE-2024-52804: 0.2.0 to 6.4.1 (6.4.2 is outside it) - CVE-2023-28370: 0.2.0 to 6.3.1 (6.3.2 is outside it) - CVE-2014-9720: 0.2.0 to 3.2.1 (3.2.2 is outside it) - CVE-2012-2374: 0.2.0 to 2.2.0 (2.2.1 is outside it) ## Advisories (26) ### [CVE-2026-116578](https://cve.now/CVE-2026-116578): Tornado: Open redirect in RedirectHandler via protocol-relative URLs - Severity: Low 2.1 - Published: Oct 26, 2026 - Affected: fixed in 6.6. - Fixed in 6.6.0 (released Oct 21, 2026, 5 days before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2026-116577](https://cve.now/CVE-2026-116577): Tornado: Quadratic CPU usage when parsing HTTP headers with line folding - Severity: Medium 5.3 - Published: Oct 26, 2026 - Affected: fixed in 6.6. - Fixed in 6.6.0 (released Oct 21, 2026, 5 days before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2026-115927](https://cve.now/CVE-2026-115927): Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks - Severity: Medium 5.3 - Published: Oct 26, 2026 - Affected: fixed in 6.6. - Fixed in 6.6.0 (released Oct 21, 2026, 5 days before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2026-103263](https://cve.now/CVE-2026-103263): Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink - Severity: High 8.2 - Published: Oct 1, 2026 - Affected: fixed in 6.5.9. - Fixed in 6.5.9 (released Sep 14, 2026, 17 days before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2026-103262](https://cve.now/CVE-2026-103262): Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient - Severity: High 8.7 - Published: Oct 1, 2026 - Affected: fixed in 6.5.9. - Fixed in 6.5.9 (released Sep 14, 2026, 17 days before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2026-103261](https://cve.now/CVE-2026-103261): Tornado before 6.5.9 Denial of Service via Query String - Severity: Medium 6.9 - Published: Oct 1, 2026 - Affected: fixed in 6.5.9. - Fixed in 6.5.9 (released Sep 14, 2026, 17 days before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2026-91992](https://cve.now/CVE-2026-91992): Tornado before 6.5.7 Credential Leak via Handle Reuse - Severity: High 8.2 - Published: Sep 15, 2026 - Affected: fixed in 6.5.7. - Fixed in 6.5.7 (released Jun 8, 2026, 99 days before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2026-91991](https://cve.now/CVE-2026-91991): Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs - Severity: Medium 6.3 - Published: Sep 15, 2026 - Affected: from 6.5.5, fixed in 6.5.8. - Fixed in 6.5.8 (released Aug 7, 2026, 39 days before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2026-91990](https://cve.now/CVE-2026-91990): Tornado before 6.5.8 Memory Amplification DoS via multipart - Severity: High 8.7 - Published: Sep 15, 2026 - Affected: fixed in 6.5.8. - Fixed in 6.5.8 (released Aug 7, 2026, 39 days before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2024-58384](https://cve.now/CVE-2024-58384): Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient - Severity: Medium 6.3 - Published: Sep 15, 2026 - Affected: fixed in 6.4.1. - Fixed in 6.4.1 (released Jun 6, 2024, 831 days before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2024-14029](https://cve.now/CVE-2024-14029): Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding - Severity: Critical 9.0 - Published: Sep 15, 2026 - Affected: fixed in 6.4.1. - Fixed in 6.4.1 (released Jun 6, 2024, 831 days before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2023-54397](https://cve.now/CVE-2023-54397): Tornado before 6.3.3 HTTP Request Smuggling via Content-Length - Severity: Critical 9.0 - Published: Sep 15, 2026 - Affected: fixed in 6.3.3. - Fixed in 6.3.3 (released Aug 11, 2023, 1131 days before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2026-82397](https://cve.now/CVE-2026-82397): Tornado: Urlencoded body parsing omits max\_num\_fields, so one request can stall the event loop - Severity: High 7.5 - Published: Aug 31, 2026 - Affected: fixed in 6.5.8. - Fixed in 6.5.8 (released Aug 7, 2026, 24 days before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2026-49855](https://cve.now/CVE-2026-49855): tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) - Severity: High 7.5 - Published: Jul 14, 2026 - Affected: fixed in 6.5.6. - Fixed in 6.5.6 (released May 27, 2026, 48 days before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2026-49854](https://cve.now/CVE-2026-49854): Tornado: Out-of-bounds memory access in C extension - Severity: Medium 5.3 - Published: Jul 14, 2026 - Affected: fixed in 6.5.6. - Fixed in 6.5.6 (released May 27, 2026, 48 days before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2026-49853](https://cve.now/CVE-2026-49853): Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient - Severity: High 7.7 - Published: Jul 14, 2026 - Affected: fixed in 6.5.6. - Fixed in 6.5.6 (released May 27, 2026, 48 days before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2026-35536](https://cve.now/CVE-2026-35536): In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to… - Severity: High 7.2 - Published: Apr 3, 2026 - Affected: fixed in 6.5.5. - Fixed in 6.5.5 (released Mar 10, 2026, 24 days before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2026-31958](https://cve.now/CVE-2026-31958): Tornado has a DoS due to too many multipart parts - Severity: High 8.7 - Published: Mar 11, 2026 - Affected: fixed in 6.5.5. - Fixed in 6.5.5 (released Mar 10, 2026, 1 day before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2025-67726](https://cve.now/CVE-2025-67726): Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters - Severity: High 7.5 - Published: Dec 12, 2025 - Affected: fixed in 6.5.3. - Fixed in 6.5.3 (released Dec 11, 2025, 1 day before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2025-67725](https://cve.now/CVE-2025-67725): Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing - Severity: High 7.5 - Published: Dec 12, 2025 - Affected: fixed in 6.5.3. - Fixed in 6.5.3 (released Dec 11, 2025, 1 day before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2025-67724](https://cve.now/CVE-2025-67724): Tornado vulnerable to Header Injection and XSS via reason argument - Severity: Medium 5.4 - Published: Dec 12, 2025 - Affected: fixed in 6.5.3. - Fixed in 6.5.3 (released Dec 11, 2025, 1 day before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2025-47287](https://cve.now/CVE-2025-47287): Tornado vulnerable to excessive logging caused by malformed multipart form data - Severity: High 7.5 - Published: May 15, 2025 - Affected: fixed in 6.5. - Fixed in 6.5.0 (released May 15, 2025, the day of disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2024-52804](https://cve.now/CVE-2024-52804): Tornado has HTTP cookie parsing DoS vulnerability - Severity: High 7.5 - Published: Nov 22, 2024 - Affected: fixed in 6.4.2. - Fixed in 6.4.2 (released Nov 22, 2024, the day of disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2023-28370](https://cve.now/CVE-2023-28370): Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an… - Severity: Medium 6.1 - Published: May 25, 2023 - Affected: fixed in 6.3.2. - Fixed in 6.3.2 (released May 14, 2023, 11 days before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2014-9720](https://cve.now/CVE-2014-9720): Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it… - Severity: Unrated - Published: Jan 24, 2020 - Affected: fixed in 3.2.2; fixed in 3.2.2. - Fixed in 3.2.2 (released Jun 4, 2014, 2060 days before disclosure). - The latest release, 6.6.0, is not affected. ### [CVE-2012-2374](https://cve.now/CVE-2012-2374): CRLF injection vulnerability in the tornado.web.RequestHandler.set\_header function in Tornado before 2.2.1 allows remote attackers to… - Severity: Unrated - Published: May 23, 2012 - Affected: fixed in 2.2.1. - Fixed in 2.2.1 (released May 22, 2014, 729 days after disclosure). - The latest release, 6.6.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/tornado Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.