Vulnerabilities in tornadoweb
8 resultsCVE-2023-28370MEDIUMOpen redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrarEPSS 1.1%CVE-2024-52804HIGHTornado has HTTP cookie parsing DoS vulnerabilityEPSS 1.1%CVE-2025-47287HIGHTornado vulnerable to excessive logging caused by malformed multipart form dataEPSS 0.6%CVE-2025-67725HIGHTornado is Vulnerable to Quadratic DoS via Repeated Header CoalescingEPSS 0.4%CVE-2026-31958HIGHTornado has a DoS due to too many multipart partsEPSS 0.4%CVE-2025-67726HIGHTornado is Vulnerable to Quadratic DoS via Crafted Multipart ParametersEPSS 0.4%CVE-2026-35536HIGHIn Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookEPSS 0.2%CVE-2025-67724MEDIUMTornado vulnerable to Header Injection and XSS via reason argumentEPSS 0.2%