[ Vendor · 8 CVEs ]
tornadoweb
CVEs affecting tornadoweb published in the last 30 days, plus any tornadoweb CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-103262 | 1 Oct 2026 | CVSS 7.5 | tornadoweb tornadoTornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause… | |
| CVE-2026-103263 | 1 Oct 2026 | CVSS 5.9 | tornadoweb tornadoTornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without… | |
| CVE-2026-103261 | 1 Oct 2026 | CVSS 5.3 | tornadoweb tornadoTornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop… | |
| CVE-2026-91990 | 15 Sep 2026 | CVSS 7.5 | tornadoweb tornadoTornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the… | |
| CVE-2024-14029 | 15 Sep 2026 | CVSS 7.5 | tornadoweb tornadoTornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body… | |
| CVE-2026-82397 | 31 Aug 2026 | CVSS 7.5 | tornadoweb tornadoTornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request… | |
| CVE-2026-49855 | 14 Jul 2026 | CVSS 7.5 | tornadoweb tornadoTornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size… | |
| CVE-2026-49853 | 14 Jul 2026 | CVSS 7.7 | tornadoweb tornadoTornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and… |