tornadoweb/tornado Security Advisories | GitStock

medium2026-09-30

Tornado: Unbounded query-string argument count allows event-loop-stalling DoS

GHSA-3hv7-mjh2-fv65

high2026-09-30

tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM

GHSA-chx6-46f5-w4vp

high2026-09-30

Tornado: StaticFileHandler follows symlinks outside static root (path traversal)

GHSA-c2m8-h5v5-343r

high2026-09-02

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

GHSA-mpf4-983q-p7j4 · CVE-2026-82397

medium2026-09-01

tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

GHSA-8423-8fgw-73vq

low2026-09-01

Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`

GHSA-wwv5-g3v4-889x

high2026-07-20

Tornado: Quadratic DoS via Crafted Multipart Parameters

GHSA-jhmp-mqwm-3gq8 · CVE-2025-67726

high2026-07-20

Tornado: Quadratic DoS via Repeated Header Coalescing

GHSA-c98p-7wgm-6p64 · CVE-2025-67725

medium2026-07-20

Tornado vulnerable to Header Injection and XSS via reason argument

GHSA-pr2v-jx2c-wg9f · CVE-2025-67724

medium2026-06-15

Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse

GHSA-pw6j-qg29-8w7f

high2026-06-15

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

GHSA-3x9g-8vmp-wqvf · CVE-2026-49853

high2026-06-15

tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

GHSA-mgf9-4vpg-hj56 · CVE-2026-49855

low2026-06-12

Tornado has out-of-bounds memory access via C extension

GHSA-cx3h-4qpv-8hc9 · CVE-2026-49854

high2026-04-03

Tornado has cookie attribute injection via .RequestHandler.set_cookie

GHSA-fqwm-6jpj-5wxc · CVE-2026-35536

high2026-03-12

Tornado is vulnerable to DoS due to too many multipart parts

GHSA-qjxf-f2mg-c6mc · CVE-2026-31958

medium2026-03-11

Tornado has incomplete validation of cookie attributes

GHSA-78cv-mqj4-43f7

high2025-05-16

Tornado vulnerable to excessive logging caused by malformed multipart form data

GHSA-7cx3-6m66-7c5m · CVE-2025-47287

high2024-11-22

Tornado has an HTTP cookie parsing DoS vulnerability

GHSA-8w49-h785-mj3c · CVE-2024-52804

medium2024-06-06

Tornado has a CRLF injection in CurlAsyncHTTPClient headers

GHSA-w235-7p84-xx57

medium2024-06-06

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado

GHSA-753j-mpmx-qq6g