Vulnerabilidades em tornadoweb
26 resultadosAnálise Vexday
Tornado Web apresenta 11 vulnerabilidades catalogadas, com 3 divulgadas nos últimos 90 dias, porém nenhuma atualmente sob exploração ativa (KEV). A fraqueza dominante é CWE-400 (Uncontrolled Resource Consumption), sem críticas de severidade máxima registradas, indicando um risco moderado e sem pressão imediata de ataque.
CVE-2023-28370MEDIUMOpen redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrarEPSS 1.1%CVE-2024-52804HIGHTornado has HTTP cookie parsing DoS vulnerabilityEPSS 1.0%CVE-2025-47287HIGHTornado vulnerable to excessive logging caused by malformed multipart form dataEPSS 0.7%CVE-2026-103262HIGHTornado before 6.5.9 Denial of Service via CurlAsyncHTTPClientEPSS 0.6%CVE-2026-49855HIGHtornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)EPSS 0.6%CVE-2025-67725HIGHTornado is Vulnerable to Quadratic DoS via Repeated Header CoalescingEPSS 0.6%CVE-2025-67726HIGHTornado is Vulnerable to Quadratic DoS via Crafted Multipart ParametersEPSS 0.5%CVE-2026-103263HIGHTornado before 6.5.9 StaticFileHandler Path Traversal via SymlinkEPSS 0.5%CVE-2026-103261MEDIUMTornado before 6.5.9 Denial of Service via Query StringEPSS 0.5%CVE-2026-116578LOWTornado: Open redirect in RedirectHandler via protocol-relative URLsEPSS 0.5%CVE-2026-49853HIGHTornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClientEPSS 0.4%CVE-2026-91990HIGHTornado before 6.5.8 Memory Amplification DoS via multipartEPSS 0.4%CVE-2026-49854MEDIUMTornado: Out-of-bounds memory access in C extensionEPSS 0.4%CVE-2026-31958HIGHTornado has a DoS due to too many multipart partsEPSS 0.4%CVE-2026-115927MEDIUMTornado: Event loop blocking and excess memory use from chunked bodies with many small chunksEPSS 0.4%CVE-2026-116577MEDIUMTornado: Quadratic CPU usage when parsing HTTP headers with line foldingEPSS 0.4%CVE-2023-54397CRITICALTornado before 6.3.3 HTTP Request Smuggling via Content-LengthEPSS 0.4%CVE-2024-14029CRITICALTornado before 6.4.1 HTTP Request Smuggling via Transfer-EncodingEPSS 0.4%CVE-2026-82397HIGHTornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loopEPSS 0.3%CVE-2026-123534HIGHTornado before 6.6 Path Traversal via static_url() Version HashingEPSS 0.3%