Ttornadoweb

Products

Exploited and recent CVEs

• CVE-2026-116578 Low 2.1 Tornado: Open redirect in RedirectHandler via protocol-relative URLs 0.5%
• CVE-2026-116577 Medium 5.3 Tornado: Quadratic CPU usage when parsing HTTP headers with line folding 0.4%
• CVE-2026-115927 Medium 5.3 Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks 0.4%
• CVE-2026-103263 Medium 5.9 Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink 0.5%
• CVE-2026-103262 High 7.5 Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient 0.6%
• CVE-2026-103261 Medium 5.3 Tornado before 6.5.9 Denial of Service via Query String 0.5%
• CVE-2026-91992 Medium 5.9 Tornado before 6.5.7 Credential Leak via Handle Reuse 0.2%
• CVE-2026-91991 Medium 5.4 Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs 0.2%
• CVE-2026-91990 High 7.5 Tornado before 6.5.8 Memory Amplification DoS via multipart 0.4%
• CVE-2024-58384 Medium 5.4 Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient 0.2%
• CVE-2024-14029 High 7.5 Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding 0.4%
• CVE-2023-54397 High 7.5 Tornado before 6.3.3 HTTP Request Smuggling via Content-Length 0.4%
• CVE-2026-82397 High 7.5 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop 0.3%
• CVE-2026-49855 High 7.5 tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) 0.6%
• CVE-2026-49854 Medium 5.3 Tornado: Out-of-bounds memory access in C extension 0.4%
• CVE-2026-49853 High 7.7 Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient 0.4%
• CVE-2026-35536 High 7.2 In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters. 0.2%
• CVE-2026-31958 High 8.7 Tornado has a DoS due to too many multipart parts 0.4%
• CVE-2025-67726 High 7.5 Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters 0.5%
• CVE-2025-67725 High 7.5 Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing 0.6%
• CVE-2025-67724 Medium 5.4 Tornado vulnerable to Header Injection and XSS via reason argument 0.2%
• CVE-2025-47287 High 7.5 Tornado vulnerable to excessive logging caused by malformed multipart form data 0.7%
• CVE-2024-52804 High 7.5 Tornado has HTTP cookie parsing DoS vulnerability 1.0%
• CVE-2023-28370 Medium 6.1 Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user acce 1.1%