Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

26 records

Vendor: tornadoweb Clear all filters
TI-2026-65638 CVE-2026-103263 · GHSA-4cjq-6jh9-w2f5

Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink

Priority HIGH 69

Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00522 Published 2026-10-01 Partial fix · 6.5.9 CWE-59
TI-2026-65637 CVE-2026-103262 · GHSA-h36x-fm6v-f9vx

Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

Priority HIGH 77

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00628 Published 2026-10-01 Partial fix · 6.5.9 CWE-409
TI-2026-65636 CVE-2026-103261 · GHSA-2v9w-f3h6-74rj

Tornado before 6.5.9 Denial of Service via Query String

Priority LOW 37

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00467 Published 2026-10-01 Partial fix · 6.5.9 CWE-770
TI-2026-62122 CVE-2026-91992 · GHSA-jqv5-7x9v-7j83

Tornado before 6.5.7 Credential Leak via Handle Reuse

Priority HIGH 69

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00239 Published 2026-09-15 Partial fix · 6.5.7 CWE-200
TI-2026-62121 CVE-2026-91991 · GHSA-jj9x-pjq2-f55m

Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs

Priority MEDIUM 61

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00247 Published 2026-09-15 Partial fix · 6.5.8 CWE-113
TI-2026-62120 CVE-2026-91990 · GHSA-wwvv-qf38-wpf3

Tornado before 6.5.8 Memory Amplification DoS via multipart

Priority HIGH 77

Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00424 Published 2026-09-15 Partial fix · 6.5.8 CWE-770
TI-2024-38463 CVE-2024-58384 · GHSA-qf37-5gqv-7f3m

Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient

Priority LOW 28

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00249 Published 2026-09-15 Partial fix · 6.4.1 CWE-113
TI-2024-13023 CVE-2024-14029 · GHSA-hr42-gv84-2f3g

Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

Priority HIGH 72

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request.

CVSS 4.0CRITICAL 9.0 Network No auth No interaction EPSS 0.00361 Published 2026-09-15 Partial fix · 6.4.1 CWE-444
TI-2023-30647 CVE-2023-54397 · GHSA-rhr2-ccgv-xvgx

Tornado before 6.3.3 HTTP Request Smuggling via Content-Length

Priority LOW 39

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters.

CVSS 4.0CRITICAL 9.0 Network No auth No interaction EPSS 0.00377 Published 2026-09-15 Partial fix · 6.3.3 CWE-444
TI-2026-24502 CVE-2026-31958 · GHSA-qjxf-f2mg-c6mc

Tornado has a DoS due to too many multipart parts

Priority MEDIUM 44

Tornado is a Python web framework and asynchronous networking library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00417 Published 2026-03-11 Partial fix · 6.5.5 CWE-400
TI-2024-35317 CVE-2024-52804 · GHSA-8w49-h785-mj3c

Tornado has HTTP cookie parsing DoS vulnerability

Priority MEDIUM 41

Tornado is a Python web framework and asynchronous networking library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01044 Published 2024-11-22 Partial fix · 6.4.2 CWE-400
TI-2023-12916 CVE-2023-28370 · GHSA-hj3f-6gcp-jg8j

Open redirect in tornadoweb Tornado

Priority LOW 30

Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially craft…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01142 Published 2023-05-25 Partial fix · 6.3.2 CWE-601
TI-2014-07904 CVE-2014-9720 · GHSA-8vpw-mgpf-mpvv

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be…

Priority LOW 34

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a s…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.02521 Published 2020-01-24 Partial fix · 3.2.2 CWE-203
Load more