Tornadoweb Tornado vulnerabilities

CVE-2026-35536 [MEDIUM] CWE-159 CVE-2026-35536: In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesi In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

CVE-2025-67724 [MEDIUM] CWE-79 CVE-2025-67724: Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason

CVE-2012-2374 [MEDIUM] CWE-20 CVE-2012-2374: CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.

CVE-2026-115927 [MEDIUM] CWE-400 CVE-2026-115927: Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decod Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other

CVE-2026-116577 [MEDIUM] CWE-407 CVE-2026-116577: Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding contin

CVE-2026-116578 [LOW] CWE-601 CVE-2026-116578: Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.Red Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginn