pypi

tornado

35 Total advisories

35 Vulnerabilities

0 Malware

Dependency scanning

Check whether tornado is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

tornado

Vulnerabilities

Tornado has a CRLF injection in CurlAsyncHTTPClient headers

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado

tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths

Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse

Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

Tornado has out-of-bounds memory access via C extension

Tornado has cookie attribute injection via .RequestHandler.set_cookie

Tornado is vulnerable to DoS due to too many multipart parts

Tornado has incomplete validation of cookie attributes

Tornado vulnerable to excessive logging caused by malformed multipart form data

Tornado has an HTTP cookie parsing DoS vulnerability

Tornado: Quadratic DoS via Crafted Multipart Parameters

Tornado: Quadratic DoS via Repeated Header Coalescing

Tornado vulnerable to Header Injection and XSS via reason argument

CVE-2026-35536

tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

Tornado has out-of-bounds memory access via C extension

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

CVE-2025-67726

CVE-2025-67724

CVE-2025-67725

Tornado vulnerable to excessive logging caused by malformed multipart form data

Tornado has an HTTP cookie parsing DoS vulnerability

CVE-2014-9720

CVE-2023-28370

CVE-2012-2374

CVE-2026-31958

Open redirect in Tornado

Tornado CRLF injection vulnerability

Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)

Browse more PyPI advisories

Start Securing