Tornadoweb vulnerabilities
26 CVEs and advisories name Tornadoweb as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-123535Tornado before 6.6 Cookie Attribute Injection via set_cookie max_age
- CVE-2026-123534Tornado before 6.6 Path Traversal via static_url() Version Hashing
- CVE-2026-116578Tornado: Open redirect in RedirectHandler via protocol-relative URLs
- CVE-2026-116577Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
- CVE-2026-115927Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
- CVE-2026-103263Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink
- CVE-2026-103262Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient
- CVE-2026-103261Tornado before 6.5.9 Denial of Service via Query String
- CVE-2026-91992Tornado before 6.5.7 Credential Leak via Handle Reuse
- CVE-2026-91991Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs
- CVE-2026-91990Tornado before 6.5.8 Memory Amplification DoS via multipart
- CVE-2024-58384Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient
- CVE-2024-14029Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
- CVE-2023-54397Tornado before 6.3.3 HTTP Request Smuggling via Content-Length
- CVE-2026-82397Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
- CVE-2026-49855tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)
- CVE-2026-49854Tornado: Out-of-bounds memory access in C extension
- CVE-2026-49853Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
- CVE-2026-35536In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cook
- CVE-2026-31958Tornado has a DoS due to too many multipart parts
- CVE-2025-67726Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters
- CVE-2025-67725Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing
- CVE-2025-67724Tornado vulnerable to Header Injection and XSS via reason argument
- CVE-2025-47287Tornado vulnerable to excessive logging caused by malformed multipart form data
- CVE-2024-52804Tornado has HTTP cookie parsing DoS vulnerability
- CVE-2023-28370Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrar