tornadoweb tornado
24 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-116578 | < 6.6 | Tornado: Open redirect in RedirectHandler via protocol-relative URLs | LOW 2.1 | 0.5 % | ||
| CVE-2026-116577 | < 6.6 | Tornado: Quadratic CPU usage when parsing HTTP headers with line folding | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-115927 | < 6.6.0 | Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-103263 | < 6.5.9 | Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink | HIGH 8.2 | 0.5 % | ||
| CVE-2026-103262 | < 6.5.9 | Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient | HIGH 8.7 | 0.6 % | ||
| CVE-2026-103261 | < 6.5.9 | Tornado before 6.5.9 Denial of Service via Query String | MEDIUM 6.9 | 0.5 % | ||
| CVE-2026-91992 | < 6.5.7 | Tornado before 6.5.7 Credential Leak via Handle Reuse | HIGH 8.2 | 0.2 % | ||
| CVE-2026-91991 | 6.5.5 – < 6.5.8 | Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-91990 | < 6.5.8 | Tornado before 6.5.8 Memory Amplification DoS via multipart | HIGH 8.7 | 0.4 % | ||
| CVE-2024-58384 | < 6.4.1 | Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient | MEDIUM 6.3 | 0.2 % | ||
| CVE-2024-14029 | < 6.4.1 | Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding | CRITICAL 9.0 | 0.4 % | ||
| CVE-2023-54397 | < 6.3.3 | Tornado before 6.3.3 HTTP Request Smuggling via Content-Length | CRITICAL 9.0 | 0.4 % | ||
| CVE-2026-82397 | < 6.5.8 | Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop | HIGH 7.5 | 0.3 % | ||
| CVE-2026-49855 | < 6.5.6 | tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) | HIGH 7.5 | 0.6 % | ||
| CVE-2026-49854 | < 6.5.6 | Tornado: Out-of-bounds memory access in C extension | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-49853 | < 6.5.6 | Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient | HIGH 7.7 | 0.4 % | ||
| CVE-2026-35536 | < 6.5.5 | In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cook | HIGH 7.2 | 0.2 % | ||
| CVE-2026-31958 | < 6.5.5 | Tornado has a DoS due to too many multipart parts | HIGH 8.7 | 0.4 % | ||
| CVE-2025-67726 | < 6.5.3 | Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters | HIGH 7.5 | 0.5 % | ||
| CVE-2025-67725 | < 6.5.3 | Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing | HIGH 7.5 | 0.6 % | ||
| CVE-2025-67724 | < 6.5.3 | Tornado vulnerable to Header Injection and XSS via reason argument | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-47287 | < 6.5.0 | Tornado vulnerable to excessive logging caused by malformed multipart form data | HIGH 7.5 | 0.7 % | ||
| CVE-2024-52804 | < 6.4.2 | Tornado has HTTP cookie parsing DoS vulnerability | HIGH 7.5 | 1.0 % | ||
| CVE-2023-28370 | versions 6.3.1 and earlier | Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrar | MEDIUM 6.1 | 1.1 % |