tornado
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- PyPI
- Vulnerability status
- 38 advisory(ies) without a verdict
Advisories (38)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-3hv7-mjh2-fv65 Tornado: Unbounded query-string argument count allows event-loop-stalling DoS | < 6.5.9 | Undetermined |
| GHSA-3x9g-8vmp-wqvf Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient | < 6.5.6 | Undetermined |
| GHSA-753j-mpmx-qq6g Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado | < 6.4.1 | Undetermined |
| GHSA-78cv-mqj4-43f7 Tornado has incomplete validation of cookie attributes | < 6.5.5 | Undetermined |
| GHSA-7cx3-6m66-7c5m Tornado vulnerable to excessive logging caused by malformed multipart form data | < 6.5 | Undetermined |
| GHSA-8423-8fgw-73vq tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34) | < 6.5.8 | Undetermined |
| GHSA-8vpw-mgpf-mpvv Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack) | < 3.2.2 | Undetermined |
| GHSA-8w49-h785-mj3c Tornado has an HTTP cookie parsing DoS vulnerability | < 6.4.2 | Undetermined |
| GHSA-c2m8-h5v5-343r Tornado: StaticFileHandler follows symlinks outside static root (path traversal) | < 6.5.9 | Undetermined |
| GHSA-c98p-7wgm-6p64 Tornado: Quadratic DoS via Repeated Header Coalescing | < 6.5.3 | Undetermined |
| GHSA-chx6-46f5-w4vp tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM | < 6.5.9 | Undetermined |
| GHSA-cx3h-4qpv-8hc9 Tornado has out-of-bounds memory access via C extension | < 6.5.6 | Undetermined |
| GHSA-f7fv-v9rh-prvc Tornado CRLF injection vulnerability | < 2.2.1 | Undetermined |
| GHSA-fqwm-6jpj-5wxc Tornado has cookie attribute injection via .RequestHandler.set_cookie | < 6.5.5 | Undetermined |
| GHSA-hj3f-6gcp-jg8j Open redirect in Tornado | < 6.3.2 | Undetermined |
| GHSA-jhmp-mqwm-3gq8 Tornado: Quadratic DoS via Crafted Multipart Parameters | < 6.5.3 | Undetermined |
| GHSA-mgf9-4vpg-hj56 tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) | < 6.5.6 | Undetermined |
| GHSA-mpf4-983q-p7j4 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop | < 6.5.8 | Undetermined |
| GHSA-pr2v-jx2c-wg9f Tornado vulnerable to Header Injection and XSS via reason argument | < 6.5.3 | Undetermined |
| GHSA-pw6j-qg29-8w7f Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse | < 6.5.7 | Undetermined |
| GHSA-qjxf-f2mg-c6mc Tornado is vulnerable to DoS due to too many multipart parts | < 6.5.5 | Undetermined |
| GHSA-qppv-j76h-2rpx Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths | < 6.3.3 | Undetermined |
| GHSA-w235-7p84-xx57 Tornado has a CRLF injection in CurlAsyncHTTPClient headers | < 6.4.1 | Undetermined |
| GHSA-wwv5-g3v4-889x Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie` | 6.5.5 – < 6.5.8 | Undetermined |
| PYSEC-2012-5 CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP head | < 2.2.1 | Undetermined |
| PYSEC-2020-213 Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers | < 1c36307463b1e8affae100bf9386948e6c1b2308 ; < 3.2.2 | Undetermined |
| PYSEC-2023-75 Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and condu | < 6.3.2 | Undetermined |
| PYSEC-2025-265 Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers | < 6.5.3 | Undetermined |
| PYSEC-2025-266 Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the serv | < 6.5.3 | Undetermined |
| PYSEC-2025-267 Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP he | < 6.5.3 | Undetermined |
| PYSEC-2026-140 Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart | < 6.5.5 | Undetermined |
| PYSEC-2026-1974 Tornado vulnerable to excessive logging caused by malformed multipart form data | < 6.5 | Undetermined |
| PYSEC-2026-1975 Tornado has an HTTP cookie parsing DoS vulnerability | < 6.4.2 | Undetermined |
| PYSEC-2026-2287 In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked | < 6.5.5 | Undetermined |
| PYSEC-2026-3387 Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient | < 6.5.6 | Undetermined |
| PYSEC-2026-3388 Tornado has out-of-bounds memory access via C extension | < 6.5.6 | Undetermined |
| PYSEC-2026-3389 tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) | < 6.5.6 | Undetermined |
| PYSEC-2026-3928 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop | < 6.5.8 | Undetermined |
Sources
| Source | Licence |
|---|