tornadoweb vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20241
3. 20254
4. 202620

Newest CVEs

• CVE-2026-123535

  Tornado before 6.6 Cookie Attribute Injection via set_cookie max_age

  tornadoweb · tornado

  Low2.3
• CVE-2026-123534

  Tornado before 6.6 Path Traversal via static_url() Version Hashing

  tornadoweb · tornado

  High8.3
• CVE-2026-116578

  Tornado: Open redirect in RedirectHandler via protocol-relative URLs

  tornadoweb · tornado

  Low2.1
• CVE-2026-116577

  Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

  tornadoweb · tornado

  Medium5.3
• CVE-2026-115927

  Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

  tornadoweb · tornado

  Medium5.3
• CVE-2026-103263

  Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink

  tornadoweb · tornado

  High8.2
• CVE-2026-103262

  Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

  tornadoweb · tornado

  High8.7
• CVE-2026-103261

  Tornado before 6.5.9 Denial of Service via Query String

  tornadoweb · tornado

  Medium6.9
• CVE-2026-91992

  Tornado before 6.5.7 Credential Leak via Handle Reuse

  tornadoweb · tornado

  High8.2
• CVE-2026-91991

  Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs

  tornadoweb · tornado

  Medium6.3