tornado

Tornado: Unbounded query-string argument count allows event-loop-stalling DoS

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

Tornado has incomplete validation of cookie attributes

Tornado vulnerable to excessive logging caused by malformed multipart form data

tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

Tornado: StaticFileHandler follows symlinks outside static root (path traversal)

Tornado: Quadratic DoS via Repeated Header Coalescing

tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM

Tornado has out-of-bounds memory access via C extension

Tornado: Quadratic DoS via Crafted Multipart Parameters

tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Tornado vulnerable to Header Injection and XSS via reason argument

Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse

Tornado is vulnerable to DoS due to too many multipart parts

Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`