TI-2026-24502 CVE-2026-31958 · GHSA-qjxf-f2mg-c6mc
Tornado has a DoS due to too many multipart parts
Priority MEDIUM 44
Tornado is a Python web framework and asynchronous networking library.
RHSA-2026:24342
python-tornado security update
Released 2026-06-08 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server Optional (v. 7 ELS) python-tornado-4.2.1-5.el7_9.3, python-tornado-doc-4.2.1-5.el7_9.3
Fixes 2 records
TI-2026-27646 CVE-2026-35536 · GHSA-fqwm-6jpj-5wxc
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path…
Priority LOW 37
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.