Priority LOW 37
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
CVSS 3.1HIGH 7.2· Network · No auth · No interaction · EPSS 0.00246 · Published 2026-04-03 · Partial fix · 6.5.5 CWE-159
Priority MEDIUM 44
Tornado is a Python web framework and asynchronous networking library.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00417 · Published 2026-03-11 · Partial fix · 6.5.5 CWE-400
Priority MEDIUM 40
Tornado is a Python web framework and asynchronous networking library.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00535 · Published 2025-12-12 · Partial fix · 6.5.3 CWE-400
Priority MEDIUM 40
Tornado is a Python web framework and asynchronous networking library.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00559 · Published 2025-12-12 · Partial fix · 6.5.3 CWE-400
Priority LOW 27
Tornado is a Python web framework and asynchronous networking library.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0024 · Published 2025-12-12 · Partial fix · 6.5.3 CWE-644
Priority MEDIUM 40
Tornado is a Python web framework and asynchronous networking library.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00745 · Published 2025-05-15 · Partial fix · 6.5.0, 6.5 CWE-770
Priority MEDIUM 41
Tornado is a Python web framework and asynchronous networking library.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01044 · Published 2024-11-22 · Partial fix · 6.4.2 CWE-400
Priority LOW 30
Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially craft…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01142 · Published 2023-05-25 · Partial fix · 6.3.2 CWE-601
Priority LOW 34
Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a s…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02521 · Published 2020-01-24 · Partial fix · 3.2.2 CWE-203
Priority LOW 26
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.01346 · Published 2012-05-23 · Fixed in 2.2.1 CWE-20
THREATIST.IORead the docs