TI-2026-24502 CVE-2026-31958 · GHSA-qjxf-f2mg-c6mc
Tornado has a DoS due to too many multipart parts
Priority MEDIUM 44
Tornado is a Python web framework and asynchronous networking library.
tornadoweb
Records26All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high13CVSS 7.0–8.9
Exploited now
tornadoweb records in CISA KEVNo tornadoweb vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
10 records in Tornado · all components
TI-2024-35317 CVE-2024-52804 · GHSA-8w49-h785-mj3c
Tornado has HTTP cookie parsing DoS vulnerability
Priority MEDIUM 41
Tornado is a Python web framework and asynchronous networking library.
TI-2025-41422 CVE-2025-67726 · GHSA-jhmp-mqwm-3gq8
Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters
Priority MEDIUM 40
Tornado is a Python web framework and asynchronous networking library.
TI-2025-41421 CVE-2025-67725 · GHSA-c98p-7wgm-6p64
Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing
Priority MEDIUM 40
Tornado is a Python web framework and asynchronous networking library.
TI-2025-29817 CVE-2025-47287 · GHSA-7cx3-6m66-7c5m
Tornado vulnerable to excessive logging caused by malformed multipart form data
Priority MEDIUM 40
Tornado is a Python web framework and asynchronous networking library.
TI-2026-27646 CVE-2026-35536 · GHSA-fqwm-6jpj-5wxc
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path…
Priority LOW 37
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
TI-2014-07904 CVE-2014-9720 · GHSA-8vpw-mgpf-mpvv
Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be…
Priority LOW 34
Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a s…
TI-2023-12916 CVE-2023-28370 · GHSA-hj3f-6gcp-jg8j
Open redirect in tornadoweb Tornado
Priority LOW 30
Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially craft…
TI-2025-41420 CVE-2025-67724 · GHSA-pr2v-jx2c-wg9f
Tornado vulnerable to Header Injection and XSS via reason argument
Priority LOW 27
Tornado is a Python web framework and asynchronous networking library.
TI-2012-02103 CVE-2012-2374 · GHSA-f7fv-v9rh-prvc
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in…
Priority LOW 26
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted…