debian/python-tornado vulnerabilities

Latest debian/python-tornado CVEs

Newest publication first · page 2 of 2

1. DLA-4188-1 python-tornado - security update

   Published 2025-05-29

   Unknown

2. CVE-2025-47287 Tornado vulnerable to excessive logging caused by malformed multipart form data

   Published 2025-05-15

   High·CVSS 7.5 EPSS 0.75%

   Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume...

3. DLA-4007-1 python-tornado - security update

   Published 2025-01-01

   Unknown

4. CVE-2024-52804 Tornado has HTTP cookie parsing DoS vulnerability

   Published 2024-11-22

   High·CVSS 7.5 EPSS 1.0%

   Tornado is a Python web framework and asynchronous networking library. The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This par...

5. CVE-2023-28370 Open redirect in Tornado

   Published 2023-05-25

   Medium·CVSS 6.1 EPSS 1.1%

   Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

6. CVE-2014-9720 Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)

   Published 2020-01-24

   Medium·CVSS 6.5 EPSS 2.5%

   Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

7. DLA-475-1 python-tornado - security update

   Published 2016-05-15

   Unknown

8. DLA-279-1 python-tornado - security update

   Published 2015-07-22

   Unknown

9. CVE-2013-2099 Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x, and earlier, and unspecified versions of python-backports-ssl_match_hostname as used for older Python ve...

   Published 2013-10-09

   Medium·CVSS 4.3 EPSS 4.9%

   Algorithmic complexity vulnerability in the ssl.match_hostname function in Python 3.2.x, 3.3.x, and earlier, and unspecified versions of python-backports-ssl_match_hostname as used for older Python versions, allows remote attackers to cause a denial of service (CPU consumption) v...

10. CVE-2012-2374 Tornado CRLF injection vulnerability

    Published 2012-05-23

    Medium·CVSS 5.0 EPSS 1.3%

    CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.