Tornado
This hub aggregates every CVE we track for Tornado, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
18
CVEs tracked
1
Critical
11
High
0
In CISA KEV
Severity distribution
HIGH11MEDIUM6CRITICAL1
Monthly trend
0
0
2
0
0
0
1
0
1
0
0
0
0
0
0
3
0
0
1
1
0
0
3
0
2024-092026-08
Latest CVEs
The 15 most recently published vulnerabilities affecting Tornado.
- CVE-2026-49855tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)7.5
- CVE-2026-49854Tornado: Out-of-bounds memory access in C extension5.3
- CVE-2026-49853Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient7.7
- CVE-2026-35536In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.7.2
- CVE-2026-31958Tornado has a DoS due to too many multipart parts7.5
- CVE-2025-67726Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters7.5
- CVE-2025-67725Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing7.5
- CVE-2025-67724Tornado vulnerable to Header Injection and XSS via reason argument5.4
- CVE-2025-47287Tornado vulnerable to excessive logging caused by malformed multipart form data7.5
- CVE-2024-42733An issue in Docmosis Tornado v.2.9.7 and before allows a remote attacker to execute arbitrary code via a crafted script to the UNC path input9.8
- CVE-2024-52804Tornado has HTTP cookie parsing DoS vulnerability7.5
- BDU:2024-09874Уязвимость компонента CurlAsyncHTTPClient асинхронной сетевой библиотеки Tornado, позволяющая нарушителю выполнить произвольный код6.5
- CVE-2023-28370Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user a...6.1
- CVE-2023-25264An issue was discovered in Docmosis Tornado prior to version 2.9.5. An unauthenticated attacker can bypass the authentication check filter completely by introducing a specially crafted request with...7.5
- CVE-2023-25265Docmosis Tornado <= 2.9.4 is vulnerable to Directory Traversal leading to the disclosure of arbitrary content on the file system.7.5
Product normalization is registry-driven with AI assist and human review. How it works