Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: tornadoweb tornado 6.5.9 Clear all filters
TI-2026-65638 CVE-2026-103263 · GHSA-4cjq-6jh9-w2f5

Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink

Priority HIGH 69

Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00522 Published 2026-10-01 Partial fix · 6.5.9 CWE-59
TI-2026-65637 CVE-2026-103262 · GHSA-h36x-fm6v-f9vx

Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

Priority HIGH 77

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00628 Published 2026-10-01 Partial fix · 6.5.9 CWE-409
TI-2026-65636 CVE-2026-103261 · GHSA-2v9w-f3h6-74rj

Tornado before 6.5.9 Denial of Service via Query String

Priority LOW 37

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00467 Published 2026-10-01 Partial fix · 6.5.9 CWE-770