# What changed in tornado

> 19 changes in tornado 6 from its official release notes, upgrade guides and advisories: 19 security. Each one cited. Sources checked 2026-10-31. HTML: https://unstale.sh/pypi/tornado/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## tornado 6

### Security

- Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks (6.6) — [security advisory](https://github.com/advisories/GHSA-R4J5-9XPP-3985)
- Tornado: Open redirect in RedirectHandler via protocol-relative URLs (6.6) — [security advisory](https://github.com/advisories/GHSA-PW9P-V7R6-GX4P)
- Tornado: Quadratic CPU usage when parsing HTTP headers with line folding (6.6) — [security advisory](https://github.com/advisories/GHSA-PCG2-G6CJ-Q92C)
- tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM (6.5.9) — [security advisory](https://github.com/advisories/GHSA-CHX6-46F5-W4VP)
- Tornado: StaticFileHandler follows symlinks outside static root (path traversal) (6.5.9) — [security advisory](https://github.com/advisories/GHSA-C2M8-H5V5-343R)
- Tornado: Unbounded query-string argument count allows event-loop-stalling DoS (6.5.9) — [security advisory](https://github.com/advisories/GHSA-3HV7-MJH2-FV65)
- Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie` (6.5.8) — [security advisory](https://github.com/advisories/GHSA-WWV5-G3V4-889X)
- tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34) (6.5.8) — [security advisory](https://github.com/advisories/GHSA-8423-8FGW-73VQ)
- Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop (6.5.8) — [security advisory](https://github.com/advisories/GHSA-MPF4-983Q-P7J4)
- Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse (6.5.7) — [security advisory](https://github.com/advisories/GHSA-PW6J-QG29-8W7F)
- tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) (6.5.6) — [security advisory](https://github.com/advisories/GHSA-MGF9-4VPG-HJ56)
- Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (6.5.6) — [security advisory](https://github.com/advisories/GHSA-3X9G-8VMP-WQVF)
- Tornado has out-of-bounds memory access via C extension (6.5.6) — [security advisory](https://github.com/advisories/GHSA-CX3H-4QPV-8HC9)
- Tornado has cookie attribute injection via .RequestHandler.set_cookie (6.5.5) — [security advisory](https://github.com/advisories/GHSA-FQWM-6JPJ-5WXC)
- Tornado has incomplete validation of cookie attributes (6.5.5) — [security advisory](https://github.com/advisories/GHSA-78CV-MQJ4-43F7)
- Tornado is vulnerable to DoS due to too many multipart parts (6.5.5) — [security advisory](https://github.com/advisories/GHSA-QJXF-F2MG-C6MC)
- Tornado: Quadratic DoS via Crafted Multipart Parameters (6.5.3) — [security advisory](https://github.com/advisories/GHSA-JHMP-MQWM-3GQ8)
- Tornado: Quadratic DoS via Repeated Header Coalescing (6.5.3) — [security advisory](https://github.com/advisories/GHSA-C98P-7WGM-6P64)
- Tornado vulnerable to Header Injection and XSS via reason argument (6.5.3) — [security advisory](https://github.com/advisories/GHSA-PR2V-JX2C-WG9F)