tornado
Page établie d’après les avis qui citent ce paquet : ses métadonnées de registre (versions, licence, dépendances) n’ont pas encore été récupérées par ce service.
En bref
- Écosystème
- PyPI
- État de vulnérabilité
- 38 avis sans verdict
Avis (38)
| Avis | Versions affectées | Dernière version |
|---|---|---|
| GHSA-3hv7-mjh2-fv65 Tornado: Unbounded query-string argument count allows event-loop-stalling DoS | < 6.5.9 | Indéterminé |
| GHSA-3x9g-8vmp-wqvf Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient | < 6.5.6 | Indéterminé |
| GHSA-753j-mpmx-qq6g Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado | < 6.4.1 | Indéterminé |
| GHSA-78cv-mqj4-43f7 Tornado has incomplete validation of cookie attributes | < 6.5.5 | Indéterminé |
| GHSA-7cx3-6m66-7c5m Tornado vulnerable to excessive logging caused by malformed multipart form data | < 6.5 | Indéterminé |
| GHSA-8423-8fgw-73vq tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34) | < 6.5.8 | Indéterminé |
| GHSA-8vpw-mgpf-mpvv Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack) | < 3.2.2 | Indéterminé |
| GHSA-8w49-h785-mj3c Tornado has an HTTP cookie parsing DoS vulnerability | < 6.4.2 | Indéterminé |
| GHSA-c2m8-h5v5-343r Tornado: StaticFileHandler follows symlinks outside static root (path traversal) | < 6.5.9 | Indéterminé |
| GHSA-c98p-7wgm-6p64 Tornado: Quadratic DoS via Repeated Header Coalescing | < 6.5.3 | Indéterminé |
| GHSA-chx6-46f5-w4vp tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM | < 6.5.9 | Indéterminé |
| GHSA-cx3h-4qpv-8hc9 Tornado has out-of-bounds memory access via C extension | < 6.5.6 | Indéterminé |
| GHSA-f7fv-v9rh-prvc Tornado CRLF injection vulnerability | < 2.2.1 | Indéterminé |
| GHSA-fqwm-6jpj-5wxc Tornado has cookie attribute injection via .RequestHandler.set_cookie | < 6.5.5 | Indéterminé |
| GHSA-hj3f-6gcp-jg8j Open redirect in Tornado | < 6.3.2 | Indéterminé |
| GHSA-jhmp-mqwm-3gq8 Tornado: Quadratic DoS via Crafted Multipart Parameters | < 6.5.3 | Indéterminé |
| GHSA-mgf9-4vpg-hj56 tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) | < 6.5.6 | Indéterminé |
| GHSA-mpf4-983q-p7j4 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop | < 6.5.8 | Indéterminé |
| GHSA-pr2v-jx2c-wg9f Tornado vulnerable to Header Injection and XSS via reason argument | < 6.5.3 | Indéterminé |
| GHSA-pw6j-qg29-8w7f Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse | < 6.5.7 | Indéterminé |
| GHSA-qjxf-f2mg-c6mc Tornado is vulnerable to DoS due to too many multipart parts | < 6.5.5 | Indéterminé |
| GHSA-qppv-j76h-2rpx Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths | < 6.3.3 | Indéterminé |
| GHSA-w235-7p84-xx57 Tornado has a CRLF injection in CurlAsyncHTTPClient headers | < 6.4.1 | Indéterminé |
| GHSA-wwv5-g3v4-889x Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie` | 6.5.5 – < 6.5.8 | Indéterminé |
| PYSEC-2012-5 CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP head | < 2.2.1 | Indéterminé |
| PYSEC-2020-213 Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers | < 1c36307463b1e8affae100bf9386948e6c1b2308 ; < 3.2.2 | Indéterminé |
| PYSEC-2023-75 Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and condu | < 6.3.2 | Indéterminé |
| PYSEC-2025-265 Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers | < 6.5.3 | Indéterminé |
| PYSEC-2025-266 Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the serv | < 6.5.3 | Indéterminé |
| PYSEC-2025-267 Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP he | < 6.5.3 | Indéterminé |
| PYSEC-2026-140 Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart | < 6.5.5 | Indéterminé |
| PYSEC-2026-1974 Tornado vulnerable to excessive logging caused by malformed multipart form data | < 6.5 | Indéterminé |
| PYSEC-2026-1975 Tornado has an HTTP cookie parsing DoS vulnerability | < 6.4.2 | Indéterminé |
| PYSEC-2026-2287 In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked | < 6.5.5 | Indéterminé |
| PYSEC-2026-3387 Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient | < 6.5.6 | Indéterminé |
| PYSEC-2026-3388 Tornado has out-of-bounds memory access via C extension | < 6.5.6 | Indéterminé |
| PYSEC-2026-3389 tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) | < 6.5.6 | Indéterminé |
| PYSEC-2026-3928 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop | < 6.5.8 | Indéterminé |
Sources
| Source | Licence |
|---|