Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 28

Export CSV
CVE-2026-123534

Tornado before 6.6 Path Traversal via static_url() Version Hashing

Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.static_url() and get_version() that allows attackers to hash files outside static_path using ../ sequences. Attackers controlling input passed to static_url() can obtain SHA-512 hashes of readable files to confirm their existence, or reference /dev/zero to block the event loop indefinitely.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2026-123535

Tornado before 6.6 Cookie Attribute Injection via set_cookie max_age

Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by set_signed_cookie, set_secure_cookie, and clear_cookie), allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as max_age, an attacker can embed attributes such as Domain, Path, or Secure to widen the cookie's scope to parent paths or other subdomains.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2026-116577

Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2026-116578

Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2026-115927

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2025-67724

Tornado vulnerable to Header Injection and XSS via reason argument

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2026-103262

Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2026-103263

Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink

Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request it to read files such as configuration files, private keys, and application secrets accessible to the process user.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2026-103261

Tornado before 6.5.9 Denial of Service via Query String

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts to degrade response times for all clients sharing the same IOLoop.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2024-14029

Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2026-91991

Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2023-54397

Tornado before 6.3.3 HTTP Request Smuggling via Content-Length

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2024-58384

Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2026-91992

Tornado before 6.5.7 Credential Leak via Handle Reuse

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2026-91990

Tornado before 6.5.8 Memory Amplification DoS via multipart

Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2026-82397

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2026-49853

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2026-49855

tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in version 6.5.6.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2026-49854

Tornado: Out-of-bounds memory access in C extension

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado
CVE-2026-35536

tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado