Product by Tornadoweb
Tornado
26 known vulnerabilities in Tornado (Tornadoweb), 0 of them actively exploited (CISA KEV).
Key figures
26
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-103262 | Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient | 7.5 | |
| Medium | CVE-2014-9720 | Tornado: Cross-Site Request Forgery (CSRF) | 6.5 | |
| High | CVE-2026-103263 | Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink | 5.9 | |
| High | CVE-2026-91990 | Tornado before 6.5.8 Memory Amplification DoS via multipart | 7.5 | |
| Critical | CVE-2023-54397 | Tornado before 6.3.3 HTTP Request Smuggling via Content-Length | 7.5 | |
| Critical | CVE-2024-14029 | Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding | 7.5 | |
| High | CVE-2024-52804 | Tornado has HTTP cookie parsing DoS vulnerability | 7.5 | |
| Medium | CVE-2026-103261 | Tornado before 6.5.9 Denial of Service via Query String | 5.3 | |
| High | CVE-2026-49855 | tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) | 7.5 | |
| High | CVE-2026-31958 | Tornado has a DoS due to too many multipart parts | 7.5 | |
| High | CVE-2026-49853 | Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient | 7.7 | |
| High | CVE-2025-47287 | Tornado vulnerable to excessive logging caused by malformed multipart form data | 7.5 | |
| Medium | CVE-2023-28370 | Tornado: Open Redirect | 6.1 | |
| High | CVE-2026-91992 | Tornado before 6.5.7 Credential Leak via Handle Reuse | 5.9 | |
| High | CVE-2026-82397 | Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop | 7.5 | |
| High | CVE-2025-67725 | Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing | 7.5 | |
| High | CVE-2025-67726 | Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters | 7.5 | |
| Medium | CVE-2026-116577 | Tornado: Quadratic CPU usage when parsing HTTP headers with line folding | 5.3 | |
| Medium | CVE-2026-115927 | Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks | 5.3 | |
| Medium | CVE-2024-58384 | Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient | 5.4 | |
| Medium | CVE-2026-91991 | Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs | 5.4 | |
| Medium | CVE-2026-49854 | Tornado: Out-of-bounds memory access in C extension | 5.3 | |
| High | CVE-2026-35536 | Tornado: Improper Handling of Invalid Use of Special Elements | 7.2 | |
| Low | CVE-2026-116578 | Tornado: Open redirect in RedirectHandler via protocol-relative URLs | — | |
| Medium | CVE-2025-67724 | Tornado vulnerable to Header Injection and XSS via reason argument | 5.4 |