tornadoweb
OSS Librariesoss-project
Top products
Latest CVEs
The 10 most recently published vulnerabilities affecting tornadoweb.
- CVE-2026-35536In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.7.2
- CVE-2026-31958Tornado has a DoS due to too many multipart parts7.5
- CVE-2025-67726Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters7.5
- CVE-2025-67725Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing7.5
- CVE-2025-67724Tornado vulnerable to Header Injection and XSS via reason argument5.4
- CVE-2025-47287Tornado vulnerable to excessive logging caused by malformed multipart form data7.5
- CVE-2024-52804Tornado has HTTP cookie parsing DoS vulnerability7.5
- CVE-2023-28370Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user a...6.1
- CVE-2014-9720Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and deter...6.5
- CVE-2012-2374CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitti...5.0