tornadoweb Tornado vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20241
3. 20254
4. 202618

Newest CVEs

• CVE-2026-116578

  Tornado: Open redirect in RedirectHandler via protocol-relative URLs

  tornadoweb · tornado

  Low2.1
• CVE-2026-116577

  Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

  tornadoweb · tornado

  Medium5.3
• CVE-2026-115927

  Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

  tornadoweb · tornado

  Medium5.3
• CVE-2026-103263

  Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink

  tornadoweb · tornado

  High8.2
• CVE-2026-103262

  Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

  tornadoweb · tornado

  High8.7
• CVE-2026-103261

  Tornado before 6.5.9 Denial of Service via Query String

  tornadoweb · tornado

  Medium6.9
• CVE-2026-91992

  Tornado before 6.5.7 Credential Leak via Handle Reuse

  tornadoweb · tornado

  High8.2
• CVE-2026-91991

  Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs

  tornadoweb · tornado

  Medium6.3
• CVE-2026-91990

  Tornado before 6.5.8 Memory Amplification DoS via multipart

  tornadoweb · tornado

  High8.7
• CVE-2024-58384

  Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient

  tornadoweb · tornado

  Medium6.3