What’s Vulnerable › Products
tornadoweb tornado vulnerabilities
26 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 23 published in the last 12 months.
Check whether your tornadoweb tornado version is affected
Latest tornadoweb tornado vulnerabilities
- CVE-2026-116578 — Tornado: Open redirect in RedirectHandler via protocol-relative URLs (CVSS 2.1)
- CVE-2026-116577 — Tornado: Quadratic CPU usage when parsing HTTP headers with line folding (CVSS 5.3)
- CVE-2026-115927 — Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks (CVSS 5.3)
- CVE-2026-103263 — Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink (CVSS 5.9)
- CVE-2026-103262 — Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient (CVSS 7.5)
- CVE-2026-103261 — Tornado before 6.5.9 Denial of Service via Query String (CVSS 5.3)
- CVE-2026-91992 — Tornado before 6.5.7 Credential Leak via Handle Reuse (CVSS 5.9)
- CVE-2026-91991 — Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs (CVSS 5.4)
- CVE-2026-91990 — Tornado before 6.5.8 Memory Amplification DoS via multipart (CVSS 7.5)
- CVE-2024-58384 — Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient (CVSS 5.4)
- CVE-2024-14029 — Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding (CVSS 7.5)
- CVE-2023-54397 — Tornado before 6.3.3 HTTP Request Smuggling via Content-Length (CVSS 7.5)
- CVE-2026-82397 — Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop (CVSS 7.5)
- CVE-2026-49855 — tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) (CVSS 7.5)
- CVE-2026-49854 — Tornado: Out-of-bounds memory access in C extension (CVSS 5.3)
- CVE-2026-49853 — Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (CVSS 7.7)
- CVE-2026-35536 — (CVSS 5.3)
- CVE-2026-31958 — Tornado has a DoS due to too many multipart parts (CVSS 7.5)
- CVE-2025-67726 — Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters (CVSS 7.5)
- CVE-2025-67725 — Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing (CVSS 7.5)
- CVE-2025-67724 — Tornado vulnerable to Header Injection and XSS via reason argument (CVSS 6.1)
- CVE-2025-47287 — Tornado vulnerable to excessive logging caused by malformed multipart form data (CVSS 7.5)
- CVE-2024-52804 — Tornado has HTTP cookie parsing DoS vulnerability (CVSS 7.5)
- CVE-2023-28370 — (CVSS 6.1)
- CVE-2014-9720 — (CVSS 6.5)