Tornado — CVE history (PyPI)
Tornado
23 CVEs affect the Tornado PyPI package (highest CVSS 7.7). Latest disclosed: 2026-10-01. Full CVE history sourced from NVD.
Summary
- Package
Tornado(PyPI)- Total CVEs
23- Actively exploited (CISA KEV)
- 0
- Highest CVSS
7.7- Latest disclosed
- 2026-10-01
Recent CVEs (top 20)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2026-103263 | Medium | 5.9 | — | 2026-10-01 | Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. |
CVE-2026-103262 | High | 7.5 | — | 2026-10-01 | Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. |
CVE-2026-103261 | Medium | 5.3 | — | 2026-10-01 | Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. |
CVE-2026-91992 | Medium | 5.9 | — | 2026-09-15 | Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. |
CVE-2026-91991 | Medium | 5.4 | — | 2026-09-15 | Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. |
CVE-2026-91990 | High | 7.5 | — | 2026-09-15 | Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. |
CVE-2024-58384 | Medium | 5.4 | — | 2026-09-15 | Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. |
CVE-2024-14029 | High | 7.5 | — | 2026-09-15 | Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. |
CVE-2023-54397 | High | 7.5 | — | 2026-09-15 | Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. |
CVE-2026-82397 | High | 7.5 | — | 2026-08-31 | Tornado is a Python web framework and asynchronous networking library. |
CVE-2026-49855 | High | 7.5 | — | 2026-07-14 | Tornado is a Python web framework and asynchronous networking library. |
CVE-2026-49854 | Medium | 5.3 | — | 2026-07-14 | Tornado is a Python web framework and asynchronous networking library. |
CVE-2026-49853 | High | 7.7 | — | 2026-07-14 | Tornado is a Python web framework and asynchronous networking library. |
CVE-2026-35536 | High | 7.2 | — | 2026-04-03 | In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters. |
CVE-2026-31958 | High | 7.5 | — | 2026-03-11 | Tornado is a Python web framework and asynchronous networking library. |
CVE-2025-67726 | High | 7.5 | — | 2025-12-12 | Tornado is a Python web framework and asynchronous networking library. |
CVE-2025-67725 | High | 7.5 | — | 2025-12-12 | Tornado is a Python web framework and asynchronous networking library. |
CVE-2025-67724 | Medium | 5.4 | — | 2025-12-12 | Tornado is a Python web framework and asynchronous networking library. |
CVE-2025-47287 | High | 7.5 | — | 2025-05-15 | Tornado is a Python web framework and asynchronous networking library. |
CVE-2024-52804 | High | 7.5 | — | 2024-11-22 | Tornado is a Python web framework and asynchronous networking library. |
All-time worst (top 10 by CVSS)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2026-49853 | High | 7.7 | — | 2026-07-14 | Tornado is a Python web framework and asynchronous networking library. |
CVE-2026-103262 | High | 7.5 | — | 2026-10-01 | Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. |
CVE-2026-91990 | High | 7.5 | — | 2026-09-15 | Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. |
CVE-2024-14029 | High | 7.5 | — | 2026-09-15 | Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. |
CVE-2023-54397 | High | 7.5 | — | 2026-09-15 | Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. |
CVE-2026-82397 | High | 7.5 | — | 2026-08-31 | Tornado is a Python web framework and asynchronous networking library. |
CVE-2026-49855 | High | 7.5 | — | 2026-07-14 | Tornado is a Python web framework and asynchronous networking library. |
CVE-2026-31958 | High | 7.5 | — | 2026-03-11 | Tornado is a Python web framework and asynchronous networking library. |
CVE-2025-67726 | High | 7.5 | — | 2025-12-12 | Tornado is a Python web framework and asynchronous networking library. |
CVE-2025-67725 | High | 7.5 | — | 2025-12-12 | Tornado is a Python web framework and asynchronous networking library. |