tornado has 14 CVEs on record between 2024 and 2026. Disclosure cadence is accelerating: 8 in the last 90 days against 2 in the 90 before. The busiest recent month was September 2026 with 5. The median CVSS is 5.9 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-770 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.9
- Publish → KEV
- —
- Last 90 days
- 8 prev 2
Weakness classes
Products
- tornado 14
Worst active — by depth score
GHSA-chx6-46f5-w4vpHigh· 7.5tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM41GHSA-c2m8-h5v5-343rHighTornado: StaticFileHandler follows symlinks outside static root (path traversal)41CVE-2026-82397High· 7.5Tornado is a Python web framework and asynchronous networking library41CVE-2025-47287High· 7.5Tornado vulnerable to excessive logging caused by malformed multipart form data41CVE-2024-52804High· 7.5Tornado has an HTTP cookie parsing DoS vulnerability41
tornado vulnerabilities
CVEs affecting tornado, newest first. Open any entry for full detail, references, and exploit status.
14 CVEsRSS
CVE-2026-116577Medium· 5.3Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
CVE-2026-116578Low· 2.1Tornado: Open redirect in RedirectHandler via protocol-relative URLs
Tornado: Open redirect in RedirectHandler via protocol-relative URLs
GHSA-c2m8-h5v5-343rHighTornado: StaticFileHandler follows symlinks outside static root (path traversal)
Tornado: StaticFileHandler follows symlinks outside static root (path traversal)
GHSA-chx6-46f5-w4vpHigh· 7.5tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
GHSA-3hv7-mjh2-fv65Medium· 5.3Tornado: Unbounded query-string argument count allows event-loop-stalling DoS
Tornado: Unbounded query-string argument count allows event-loop-stalling DoS
GHSA-wwv5-g3v4-889xLowTornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_…
Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`
GHSA-8423-8fgw-73vqMediumtornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
CVE-2026-82397High· 7.5Tornado is a Python web framework and asynchronous networking library
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. Reques…
GHSA-pw6j-qg29-8w7fMedium· 5.9Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse
Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse
CVE-2026-49854Low· 3.7Tornado has out-of-bounds memory access via C extension
Tornado has out-of-bounds memory access via C extension
CVE-2025-47287High· 7.5Tornado vulnerable to excessive logging caused by malformed multipart form data
Tornado vulnerable to excessive logging caused by malformed multipart form data
CVE-2024-52804High· 7.5Tornado has an HTTP cookie parsing DoS vulnerability
Tornado has an HTTP cookie parsing DoS vulnerability
GHSA-w235-7p84-xx57Medium· 6.5Tornado has a CRLF injection in CurlAsyncHTTPClient headers
Tornado has a CRLF injection in CurlAsyncHTTPClient headers
GHSA-753j-mpmx-qq6gMedium· 5.3Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado