MEDIUM5.3PyPI
GHSA-3hv7-mjh2-fv65· CVE-2026-103261Tornado: Unbounded query-string argument count allows event-loop-stalling DoS
Modified: 10/2/2026
package
PyPI/tornado
pkg:pypi/tornado
HIGH7.7PyPI
GHSA-3x9g-8vmp-wqvf· CVE-2026-49853, PYSEC-2026-3387Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-753j-mpmx-qq6g· CVE-2024-14029Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado
Modified: 9/16/2026
MEDIUM5.4PyPI
GHSA-78cv-mqj4-43f7· CVE-2026-35536, GHSA-fqwm-6jpj-5wxcTornado has incomplete validation of cookie attributes
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-7cx3-6m66-7c5m· CVE-2025-47287, PYSEC-2026-1974Tornado vulnerable to excessive logging caused by malformed multipart form data
Modified: 9/10/2026
MEDIUM6.9PyPI
GHSA-8423-8fgw-73vq· CVE-2026-91990tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
Modified: 9/16/2026
MEDIUM6.5PyPI
GHSA-8vpw-mgpf-mpvv· CVE-2014-9720, PYSEC-2020-213Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)
Modified: 11/13/2024
HIGH7.5PyPI
GHSA-8w49-h785-mj3c· CVE-2024-52804, PYSEC-2026-1975Tornado has an HTTP cookie parsing DoS vulnerability
Modified: 9/10/2026
HIGH8.2PyPI
GHSA-c2m8-h5v5-343r· CVE-2026-103263Tornado: StaticFileHandler follows symlinks outside static root (path traversal)
Modified: 10/2/2026
HIGH7.5PyPI
GHSA-c98p-7wgm-6p64· CVE-2025-67725, PYSEC-2025-266Tornado: Quadratic DoS via Repeated Header Coalescing
Modified: 7/20/2026
HIGH7.5PyPI
GHSA-chx6-46f5-w4vp· CVE-2026-103262tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
Modified: 10/2/2026
LOW3.7PyPI
GHSA-cx3h-4qpv-8hc9· CVE-2026-49854, PYSEC-2026-3388Tornado has out-of-bounds memory access via C extension
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-f7fv-v9rh-prvc· CVE-2012-2374, PYSEC-2012-5Tornado CRLF injection vulnerability
Modified: 11/18/2024
HIGH7.2PyPI
GHSA-fqwm-6jpj-5wxc· CVE-2026-35536, GHSA-78cv-mqj4-43f7Tornado has cookie attribute injection via .RequestHandler.set_cookie
Modified: 9/10/2026
MEDIUM6.1PyPI
GHSA-hj3f-6gcp-jg8j· CVE-2023-28370, PYSEC-2023-75Open redirect in Tornado
Modified: 11/4/2025
HIGH7.5PyPI
GHSA-jhmp-mqwm-3gq8· CVE-2025-67726, PYSEC-2025-267Tornado: Quadratic DoS via Crafted Multipart Parameters
Modified: 7/20/2026
HIGH7.5PyPI
GHSA-mgf9-4vpg-hj56· CVE-2026-49855, PYSEC-2026-3389tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-mpf4-983q-p7j4· CVE-2026-82397, PYSEC-2026-3928Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
Modified: 9/10/2026
MEDIUM5.4PyPI
GHSA-pr2v-jx2c-wg9f· CVE-2025-67724, PYSEC-2025-265Tornado vulnerable to Header Injection and XSS via reason argument
Modified: 7/20/2026
MEDIUM5.9PyPI
GHSA-pw6j-qg29-8w7f· CVE-2026-91992Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse
Modified: 9/16/2026
HIGH7.5PyPI
GHSA-qjxf-f2mg-c6mc· CVE-2026-31958, PYSEC-2026-140Tornado is vulnerable to DoS due to too many multipart parts
Modified: 9/10/2026
MEDIUMPyPI
GHSA-qppv-j76h-2rpx· CVE-2023-54397Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths
Modified: 9/16/2026
MEDIUM6.5PyPI
GHSA-w235-7p84-xx57· CVE-2024-58384Tornado has a CRLF injection in CurlAsyncHTTPClient headers
Modified: 9/16/2026
LOW2.3PyPI
GHSA-wwv5-g3v4-889x· CVE-2026-91991Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`
Modified: 9/16/2026
MEDIUM5.0PyPI
PYSEC-2012-5· CVE-2012-2374, GHSA-f7fv-v9rh-prvcModified: 6/10/2026
MEDIUM6.5PyPI
PYSEC-2020-213· CVE-2014-9720, GHSA-8vpw-mgpf-mpvvModified: 6/10/2026
MEDIUM6.1PyPI
PYSEC-2023-75· CVE-2023-28370, GHSA-hj3f-6gcp-jg8jModified: 6/10/2026
MEDIUM6.1PyPI
PYSEC-2025-265· CVE-2025-67724, GHSA-pr2v-jx2c-wg9fModified: 7/13/2026
HIGH7.5PyPI
PYSEC-2025-266· CVE-2025-67725, GHSA-c98p-7wgm-6p64Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2025-267· CVE-2025-67726, GHSA-jhmp-mqwm-3gq8Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-140· CVE-2026-31958, GHSA-qjxf-f2mg-c6mcModified: 5/20/2026
HIGH7.5PyPI
PYSEC-2026-1974· CVE-2025-47287, GHSA-7cx3-6m66-7c5mTornado vulnerable to excessive logging caused by malformed multipart form data
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1975· CVE-2024-52804, GHSA-8w49-h785-mj3cTornado has an HTTP cookie parsing DoS vulnerability
Modified: 7/7/2026
MEDIUM5.3PyPI
PYSEC-2026-2287· CVE-2026-35536, GHSA-78cv-mqj4-43f7Modified: 7/13/2026
HIGH7.7PyPI
PYSEC-2026-3387· CVE-2026-49853, GHSA-3x9g-8vmp-wqvfTornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
Modified: 7/13/2026
LOW3.7PyPI
PYSEC-2026-3388· CVE-2026-49854, GHSA-cx3h-4qpv-8hc9Tornado has out-of-bounds memory access via C extension
Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-3389· CVE-2026-49855, GHSA-mgf9-4vpg-hj56tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)
Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-3928· CVE-2026-82397, GHSA-mpf4-983q-p7j4Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
Modified: 9/10/2026