Python Tornado versions before 6.5.9 have a path traversal vulnerability in StaticFileHandler. This flaw allows the handler to follow symbolic links inside the static root directory without verifying that the resolved target remains within the static root. An unauthenticated attacker can exploit this by requesting a symlink pointing outside the static directory to read sensitive files accessible to the process user, such as configuration files, private keys, and application secrets. The vulnerability has a CVSS score of 5.9, indicating medium severity.
CVE-2026-103261 is a resource exhaustion vulnerability in Tornado Web server versions prior to 6.5.9. The HTTPServerRequest.__init__ method parses query strings without limiting the number of fields, unlike the POST-body parsing path which enforces a 1000-field limit. An attacker can send a GET request with thousands of query parameters, causing excessive CPU usage and blocking Tornado's single-threaded event loop, resulting in denial of service. This vulnerability affects all Tornado servers and can degrade response times for all clients sharing the same IOLoop. The issue is fixed by adding a field-count limit to query string parsing, consistent with the POST-body limit.
Tornado versions before 6.5.9 have a vulnerability in CurlAsyncHTTPClient where highly compressed gzip responses can cause unbounded memory accumulation. This can lead to denial of service by exhausting system memory and crashing the application process.
Tornado versions before 6.5.7 contain a vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without properly clearing state. This can lead to leakage of sensitive credentials such as TLS certificates or proxy authentication data across unintended requests. The vulnerability has a medium severity with a CVSS score of 5.9. Multiple specific Tornado package versions are affected. No explicit patch information is provided in the source data.
Tornado versions from 6.5.5 up to but not including 6.5.8 contain an incomplete fix for cookie attribute injection. This vulnerability allows attackers to inject arbitrary cookie attributes by using capitalized or legacy keyword arguments in the set_cookie function. By embedding semicolon-delimited data in parameters such as Domain, Path, or SameSite, attackers can bypass validation and alter cookie security attributes. The issue is classified as an HTTP request/response splitting vulnerability related to improper neutralization of CRLF sequences in HTTP headers.
CVE-2026-91990 is a high-severity denial-of-service vulnerability in the Tornado web framework affecting versions from 0 up to but not including 6.5.8. The vulnerability arises from the multipart form data parsing function, which creates a large transient list by splitting the entire request body before enforcing limits on the number of parts. This can lead to excessive memory consumption and a denial of service when processing specially crafted HTTP requests with many parts. The vulnerability is exploitable without authentication.
Tornado's CurlAsyncHTTPClient class is vulnerable to HTTP request/response splitting due to improper neutralization of CRLF sequences in HTTP headers. This vulnerability allows attackers to inject arbitrary headers or additional HTTP requests when untrusted header values are used. It affects Tornado versions prior to 6.4.1 and has a medium severity rating.
CVE-2024-14029 is a critical HTTP request smuggling vulnerability in Tornado web server versions prior to 6.4.1. It occurs when Tornado receives HTTP requests containing two Transfer-Encoding: chunked headers, causing it to ignore both and misinterpret the request body. This behavior can lead to request smuggling attacks when Tornado is deployed behind proxies that forward such malformed requests, such as Pound. The vulnerability may allow attackers to bypass access controls, poison caches, or cause connection desynchronization.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8.
Tornado's gzip decompression routines work in limited-size chunks, but have no overall limit for the total size of decompressed chunks that they will accumulate (There has always been a limit for the total *compressed* size). This allows a malicious server to consume effectively unlimited amounts of memory if it is accessed via SimpleAsyncHTTPClient in its default configuration. `HTTPServer` is not affected in its default configuration, but it is if `decompress_request=True` is set.
This bug is fixed in Tornado 6.5.6. `max_body_size` is now checked both for the compressed and cumulative decompressed size of the response.
Prior to upgrading, this issue can be mitigated by setting `decompress_response=False` or using `CurlAsyncHTTPClient`.
### Summary
Tornado's optional native extension `tornado.speedups` implements `websocket_mask` without validating that the `mask` argument is exactly four bytes long. The C function reads four bytes from `mask` unconditionally, even when Python passes a shorter byte string. This can read beyond the provided buffer, exposing up to 3 bytes of uninitialized memory.
The behavior is reachable from Tornado's XSRF token decoder when `xsrf_cookies=True` and the native extension is active.
### Mitigations
This bug is fixed in Tornado 6.5.6. Prior to upgrading to this version, setting the environment variable TORNADO_EXTENSION=0 will disable the vulnerable code (at the expense of reducing websocket performance).
CVE-2026-35536 is a high-severity vulnerability in Tornado versions before 6.5.5 where improper validation of cookie attributes (domain, path, samesite) in the set_cookie method can lead to cookie attribute injection. This occurs because these arguments are not checked for crafted characters, potentially allowing an attacker to manipulate cookie behavior. The vulnerability has a CVSS score of 7.2, indicating significant impact on confidentiality and integrity with no required privileges or user interaction. No official patch or remediation details are provided in the available data, and no known exploits are reported in the wild.
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart bodies with many parts. This vulnerability is fixed in 6.5.5.
Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period. This issue is fixed in version 6.5.3.
Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS). Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity. The severity can vary from high if max_header_size has been increased from its default, to low if it has its default value of 64KB. This issue is fixed in version 6.5.3.
Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited by passing untrusted or malicious data into the reason argument. Used by both RequestHandler.set_status and tornado.web.HTTPError, the argument is designed to allow applications to pass custom "reason" phrases (the "Not Found" in HTTP/1.1 404 Not Found) to the HTTP status line (mainly for non-standard status codes). This issue is fixed in version 6.5.3.
Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. Version 6.4.2 fixes the issue.
Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.