tornado

Security 19

• Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

  6.6security advisory

• Tornado: Open redirect in RedirectHandler via protocol-relative URLs

  6.6security advisory

• Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

  6.6security advisory

• tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM

  6.5.9security advisory

• Tornado: StaticFileHandler follows symlinks outside static root (path traversal)

  6.5.9security advisory

• Tornado: Unbounded query-string argument count allows event-loop-stalling DoS

  6.5.9security advisory

• Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive **kwargs path in set_cookie

  6.5.8security advisory

• tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

  6.5.8security advisory

• Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

  6.5.8security advisory

• Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse

  6.5.7security advisory

• tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

  6.5.6security advisory

• Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

  6.5.6security advisory

• Tornado has out-of-bounds memory access via C extension

  6.5.6security advisory

• Tornado has cookie attribute injection via .RequestHandler.set_cookie

  6.5.5security advisory

• Tornado has incomplete validation of cookie attributes

  6.5.5security advisory

• Tornado is vulnerable to DoS due to too many multipart parts

  6.5.5security advisory

• Tornado: Quadratic DoS via Crafted Multipart Parameters

  6.5.3security advisory

• Tornado: Quadratic DoS via Repeated Header Coalescing

  6.5.3security advisory

• Tornado vulnerable to Header Injection and XSS via reason argument

  6.5.3security advisory