tornado
- Software type
- Other
- Total vulnerabilities (90 days)
- 15
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, tornado recorded 15 security vulnerabilities in the last 90 days, of which 8 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of tornado and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-123535Tornado before 6.6 Cookie Attribute Injection via set_cookie max_ageCVE-2026-123534Tornado before 6.6 Path Traversal via static_url() Version HashingCVE-2026-116578Tornado: Open redirect in RedirectHandler via protocol-relative URLsCVE-2026-116577Tornado: Quadratic CPU usage when parsing HTTP headers with line foldingCVE-2026-115927Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-123535Tornado before 6.6 Cookie Attribute Injection via set_cookie max_age | Exploitation statusNot confirmed | FixYes |
| SeverityLow |
CVE-2026-123534Tornado before 6.6 Path Traversal via static_url() Version Hashing | Exploitation statusNot confirmed | FixYes | Published11/08/2026 | SeverityHigh |
|---|
CVE-2026-116578Tornado: Open redirect in RedirectHandler via protocol-relative URLs | Exploitation statusNot exploited | FixYes | Published10/26/2026 | SeverityLow |
|---|
CVE-2026-116577Tornado: Quadratic CPU usage when parsing HTTP headers with line folding | Exploitation statusNot exploited | FixYes | Published10/26/2026 | SeverityMedium |
|---|
CVE-2026-115927Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks | Exploitation statusNot exploited | FixYes | Published10/26/2026 | SeverityMedium |
|---|
CVE-2026-103263Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink | Exploitation statusActively exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-103262Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient | Exploitation statusActively exploited | FixYes | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-103261Tornado before 6.5.9 Denial of Service via Query String | Exploitation statusNot exploited | FixYes | Published10/01/2026 | SeverityMedium |
|---|
CVE-2026-91992Tornado before 6.5.7 Credential Leak via Handle Reuse | Exploitation statusActively exploited | FixYes | Published09/15/2026 | SeverityHigh |
|---|
CVE-2026-91991Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs | Exploitation statusActively exploited | FixYes | Published09/15/2026 | SeverityMedium |
|---|
CVE-2026-91990Tornado before 6.5.8 Memory Amplification DoS via multipart | Exploitation statusActively exploited | FixYes | Published09/15/2026 | SeverityHigh |
|---|
CVE-2024-58384Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient | Exploitation statusNot exploited | FixYes | Published09/15/2026 | SeverityMedium |
|---|
CVE-2024-14029Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding | Exploitation statusActively exploited | FixYes | Published09/15/2026 | SeverityCritical |
|---|
CVE-2023-54397Tornado before 6.3.3 HTTP Request Smuggling via Content-Length | Exploitation statusNot exploited | FixYes | Published09/15/2026 | SeverityCritical |
|---|
CVE-2026-82397Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop | Exploitation statusNot exploited | FixYes | Published08/31/2026 | SeverityHigh |
|---|
CVE-2026-49855tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) | Exploitation statusNot exploited | FixYes | Published07/14/2026 | SeverityHigh |
|---|
CVE-2026-49854Tornado: Out-of-bounds memory access in C extension | Exploitation statusNot exploited | FixYes | Published07/14/2026 | SeverityMedium |
|---|
CVE-2026-49853Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient | Exploitation statusNot exploited | FixYes | Published07/14/2026 | SeverityHigh |
|---|
CVE-2026-35536CVE-2026-35536 | Exploitation statusNot exploited | FixYes | Published04/03/2026 | SeverityHigh |
|---|
CVE-2026-31958Tornado has a DoS due to too many multipart parts | Exploitation statusNot exploited | FixYes | Published03/11/2026 | SeverityHigh |
|---|
CVE-2025-67726Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters | Exploitation statusNot exploited | FixYes | Published12/12/2025 | SeverityHigh |
|---|
CVE-2025-67725Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing | Exploitation statusNot exploited | FixYes | Published12/12/2025 | SeverityHigh |
|---|
CVE-2025-67724Tornado vulnerable to Header Injection and XSS via reason argument | Exploitation statusNot exploited | FixYes | Published12/12/2025 | SeverityMedium |
|---|
CVE-2025-47287Tornado vulnerable to excessive logging caused by malformed multipart form data | Exploitation statusNot exploited | FixNo | Published05/15/2025 | SeverityHigh |
|---|
CVE-2024-52804Tornado has HTTP cookie parsing DoS vulnerability | Exploitation statusNot exploited | FixNo | Published11/22/2024 | SeverityHigh |
|---|
CVE-2023-28370CVE-2023-28370 | Exploitation statusNot exploited | FixNo | Published05/25/2023 | SeverityMedium |
|---|
26 Results | Page 1 of 1