# cve.now: Tornadoweb

The newest entries naming Tornadoweb as an affected vendor (up to 200), of 26 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-123535](https://cve.now/CVE-2026-123535.md): Tornado before 6.6 Cookie Attribute Injection via set\_cookie max\_age (CVSS 2.3)
- [CVE-2026-123534](https://cve.now/CVE-2026-123534.md): Tornado before 6.6 Path Traversal via static\_url() Version Hashing (CVSS 8.3)
- [CVE-2026-116578](https://cve.now/CVE-2026-116578.md): Tornado: Open redirect in RedirectHandler via protocol-relative URLs (CVSS 2.1)
- [CVE-2026-116577](https://cve.now/CVE-2026-116577.md): Tornado: Quadratic CPU usage when parsing HTTP headers with line folding (CVSS 5.3)
- [CVE-2026-115927](https://cve.now/CVE-2026-115927.md): Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks (CVSS 5.3)
- [CVE-2026-103263](https://cve.now/CVE-2026-103263.md): Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink (CVSS 8.2)
- [CVE-2026-103262](https://cve.now/CVE-2026-103262.md): Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient (CVSS 8.7)
- [CVE-2026-103261](https://cve.now/CVE-2026-103261.md): Tornado before 6.5.9 Denial of Service via Query String (CVSS 6.9)
- [CVE-2026-91992](https://cve.now/CVE-2026-91992.md): Tornado before 6.5.7 Credential Leak via Handle Reuse (CVSS 8.2)
- [CVE-2026-91991](https://cve.now/CVE-2026-91991.md): Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs (CVSS 6.3)
- [CVE-2026-91990](https://cve.now/CVE-2026-91990.md): Tornado before 6.5.8 Memory Amplification DoS via multipart (CVSS 8.7)
- [CVE-2024-58384](https://cve.now/CVE-2024-58384.md): Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient (CVSS 6.3)
- [CVE-2024-14029](https://cve.now/CVE-2024-14029.md): Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding (CVSS 9.0)
- [CVE-2023-54397](https://cve.now/CVE-2023-54397.md): Tornado before 6.3.3 HTTP Request Smuggling via Content-Length (CVSS 9.0)
- [CVE-2026-82397](https://cve.now/CVE-2026-82397.md): Tornado: Urlencoded body parsing omits max\_num\_fields, so one request can stall the event loop (CVSS 7.5)
- [CVE-2026-49855](https://cve.now/CVE-2026-49855.md): tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) (CVSS 7.5)
- [CVE-2026-49854](https://cve.now/CVE-2026-49854.md): Tornado: Out-of-bounds memory access in C extension (CVSS 5.3)
- [CVE-2026-49853](https://cve.now/CVE-2026-49853.md): Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (CVSS 7.7)
- [CVE-2026-35536](https://cve.now/CVE-2026-35536.md): In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set\_cook (CVSS 7.2)
- [CVE-2026-31958](https://cve.now/CVE-2026-31958.md): Tornado has a DoS due to too many multipart parts (CVSS 8.7)
- [CVE-2025-67726](https://cve.now/CVE-2025-67726.md): Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters (CVSS 7.5)
- [CVE-2025-67725](https://cve.now/CVE-2025-67725.md): Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing (CVSS 7.5)
- [CVE-2025-67724](https://cve.now/CVE-2025-67724.md): Tornado vulnerable to Header Injection and XSS via reason argument (CVSS 5.4)
- [CVE-2025-47287](https://cve.now/CVE-2025-47287.md): Tornado vulnerable to excessive logging caused by malformed multipart form data (CVSS 7.5)
- [CVE-2024-52804](https://cve.now/CVE-2024-52804.md): Tornado has HTTP cookie parsing DoS vulnerability (CVSS 7.5)
- [CVE-2023-28370](https://cve.now/CVE-2023-28370.md): Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrar (CVSS 6.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/tornadoweb
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.