Data

Tools

Indexes

Applications

Experiments

Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

pypi

tornado

pypi

Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.

View on github.com · View on pypi.org

Security Advisories for tornado in pypi

High
1 day ago

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop GSA_kwCzR0hTQS1tcGY0LTk4M3EtcDdqNM4ABodI

pypi tornado
Moderate
2 days ago

tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34) GSA_kwCzR0hTQS04NDIzLThmZ3ctNzN2cc4ABnWj

pypi tornado
Low
2 days ago

Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie` GSA_kwCzR0hTQS13d3Y1LWczdjQtODg5eM4ABnWi

pypi tornado
High
about 2 months ago

Tornado: Quadratic DoS via Crafted Multipart Parameters GSA_kwCzR0hTQS1qaG1wLW1xd20tM2dxOM4ABcPq

pypi tornado
High
about 2 months ago

Tornado: Quadratic DoS via Repeated Header Coalescing GSA_kwCzR0hTQS1jOThwLTd3Z20tNnA2NM4ABcPp

pypi tornado
Moderate
about 2 months ago

Tornado vulnerable to Header Injection and XSS via reason argument GSA_kwCzR0hTQS1wcjJ2LWp4MmMtd2c5Zs4ABcPo

pypi tornado
Moderate
3 months ago

Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse GSA_kwCzR0hTQS1wdzZqLXFnMjktOHc3Zs4ABYsW

pypi tornado
High
3 months ago

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient GSA_kwCzR0hTQS0zeDlnLTh2bXAtd3F2Zs4ABYsO

pypi tornado
High
3 months ago

tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) GSA_kwCzR0hTQS1tZ2Y5LTR2cGctaGo1Ns4ABYsP

pypi tornado
Low
3 months ago

Tornado has out-of-bounds memory access via C extension GSA_kwCzR0hTQS1jeDNoLTRxcHYtOGhjOc4ABYnI

pypi tornado
High
5 months ago

Tornado has cookie attribute injection via .RequestHandler.set_cookie GSA_kwCzR0hTQS1mcXdtLTZqcGotNXd4Y84ABUrL

pypi tornado
High
6 months ago

Tornado is vulnerable to DoS due to too many multipart parts GSA_kwCzR0hTQS1xanhmLWYybWctYzZtY84ABTin

pypi tornado
Moderate
6 months ago

Tornado has incomplete validation of cookie attributes GSA_kwCzR0hTQS03OGN2LW1xajQtNDNmN84ABTgj

pypi tornado
High
over 1 year ago

Tornado vulnerable to excessive logging caused by malformed multipart form data GSA_kwCzR0hTQS03Y3gzLTZtNjYtN2M1bc4ABH_J

pypi tornado
High
almost 2 years ago

Tornado has an HTTP cookie parsing DoS vulnerability GSA_kwCzR0hTQS04dzQ5LWg3ODUtbWozY84ABBnk

pypi tornado
Moderate
about 2 years ago

Tornado has a CRLF injection in CurlAsyncHTTPClient headers GSA_kwCzR0hTQS13MjM1LTdwODQteHg1N84AA8x9

pypi tornado
Moderate
about 2 years ago

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado GSA_kwCzR0hTQS03NTNqLW1wbXgtcXE2Z84AA8x8

pypi tornado
Moderate
about 3 years ago

Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths GSA_kwCzR0hTQS1xcHB2LWo3NmgtMnJweM4AA1Sz

pypi tornado
Moderate
over 3 years ago

Open redirect in Tornado GSA_kwCzR0hTQS1oajNmLTZnY3Atamc4as4AAzeO

pypi tornado
High
over 4 years ago

Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack) GSA_kwCzR0hTQS04dnB3LW1ncGYtbXB2ds4AAgVX

pypi tornado
High
over 4 years ago

Tornado CRLF injection vulnerability GSA_kwCzR0hTQS1mN2Z2LXY5cmgtcHJ2Y84AAfig

pypi tornado

Filter by Severity

High 11 Moderate 8 Low 2