tornadoweb
- Total products in the ecosystem
- 1
- Total vulnerabilities (90 days)
- 15
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, tornadoweb recorded 15 security vulnerabilities in the last 90 days across 1 products, including 8 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, tornado had the most security vulnerabilities in the tornadoweb ecosystem, with 15 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-123535Tornado before 6.6 Cookie Attribute Injection via set_cookie max_ageCVE-2026-123534Tornado before 6.6 Path Traversal via static_url() Version HashingCVE-2026-116578Tornado: Open redirect in RedirectHandler via protocol-relative URLsCVE-2026-116577Tornado: Quadratic CPU usage when parsing HTTP headers with line foldingCVE-2026-115927Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-123535Tornado before 6.6 Cookie Attribute Injection via set_cookie max_age | Exploitation statusNot confirmed | FixYes |
| Published11/08/2026 |
| SeverityLow |
CVE-2026-123534Tornado before 6.6 Path Traversal via static_url() Version Hashing | Exploitation statusNot confirmed | FixYes | Affected producttornado | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-116578Tornado: Open redirect in RedirectHandler via protocol-relative URLs | Exploitation statusNot exploited | FixYes | Affected producttornado | Published10/26/2026 | SeverityLow |
|---|
CVE-2026-116577Tornado: Quadratic CPU usage when parsing HTTP headers with line folding | Exploitation statusNot exploited | FixYes | Affected producttornado | Published10/26/2026 | SeverityMedium |
|---|
CVE-2026-115927Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks | Exploitation statusNot exploited | FixYes | Affected producttornado | Published10/26/2026 | SeverityMedium |
|---|
CVE-2026-103263Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink | Exploitation statusActively exploited | FixYes | Affected producttornado | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-103262Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient | Exploitation statusActively exploited | FixYes | Affected producttornado | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-103261Tornado before 6.5.9 Denial of Service via Query String | Exploitation statusNot exploited | FixYes | Affected producttornado | Published10/01/2026 | SeverityMedium |
|---|
CVE-2026-91992Tornado before 6.5.7 Credential Leak via Handle Reuse | Exploitation statusActively exploited | FixYes | Affected producttornado | Published09/15/2026 | SeverityHigh |
|---|
CVE-2026-91991Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs | Exploitation statusActively exploited | FixYes | Affected producttornado | Published09/15/2026 | SeverityMedium |
|---|
CVE-2026-91990Tornado before 6.5.8 Memory Amplification DoS via multipart | Exploitation statusActively exploited | FixYes | Affected producttornado | Published09/15/2026 | SeverityHigh |
|---|
CVE-2024-58384Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient | Exploitation statusNot exploited | FixYes | Affected producttornado | Published09/15/2026 | SeverityMedium |
|---|
CVE-2024-14029Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding | Exploitation statusActively exploited | FixYes | Affected producttornado | Published09/15/2026 | SeverityCritical |
|---|
CVE-2023-54397Tornado before 6.3.3 HTTP Request Smuggling via Content-Length | Exploitation statusNot exploited | FixYes | Affected producttornado | Published09/15/2026 | SeverityCritical |
|---|
CVE-2026-82397Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop | Exploitation statusNot exploited | FixYes | Affected producttornado | Published08/31/2026 | SeverityHigh |
|---|
CVE-2026-49855tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) | Exploitation statusNot exploited | FixYes | Affected producttornado | Published07/14/2026 | SeverityHigh |
|---|
CVE-2026-49854Tornado: Out-of-bounds memory access in C extension | Exploitation statusNot exploited | FixYes | Affected producttornado | Published07/14/2026 | SeverityMedium |
|---|
CVE-2026-49853Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient | Exploitation statusNot exploited | FixYes | Affected producttornado | Published07/14/2026 | SeverityHigh |
|---|
CVE-2026-35536CVE-2026-35536 | Exploitation statusNot exploited | FixYes | Affected producttornado | Published04/03/2026 | SeverityHigh |
|---|
CVE-2026-31958Tornado has a DoS due to too many multipart parts | Exploitation statusNot exploited | FixYes | Affected producttornado | Published03/11/2026 | SeverityHigh |
|---|
CVE-2025-67726Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters | Exploitation statusNot exploited | FixYes | Affected producttornado | Published12/12/2025 | SeverityHigh |
|---|
CVE-2025-67725Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing | Exploitation statusNot exploited | FixYes | Affected producttornado | Published12/12/2025 | SeverityHigh |
|---|
CVE-2025-67724Tornado vulnerable to Header Injection and XSS via reason argument | Exploitation statusNot exploited | FixYes | Affected producttornado | Published12/12/2025 | SeverityMedium |
|---|
CVE-2025-47287Tornado vulnerable to excessive logging caused by malformed multipart form data | Exploitation statusNot exploited | FixNo | Affected producttornado | Published05/15/2025 | SeverityHigh |
|---|
CVE-2024-52804Tornado has HTTP cookie parsing DoS vulnerability | Exploitation statusNot exploited | FixNo | Affected producttornado | Published11/22/2024 | SeverityHigh |
|---|
CVE-2023-28370CVE-2023-28370 | Exploitation statusNot exploited | FixNo | Affected producttornado | Published05/25/2023 | SeverityMedium |
|---|
26 Results | Page 1 of 1