Tornadoweb vulnerabilities, page 2

23 vulnerabilities

Known vulnerabilities in Tornadoweb products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.

7.2CVE-2026-35536chainguardmitmproxy+5
EPSS score
0.29%
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.9CVE-2023-54397debianpython-tornado+3
EPSS score
0.38%
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.6.1CVE-2023-28370debianpython-tornado+98
EPSS score
1.14%
Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.