# tornado (PyPI) vulnerabilities Source: https://junglewise.ai/threats/technologies/tornado Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/tornado.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 26 vulnerabilities in tornado (PyPI): 0 in the last 7 days and 13 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116578, was published on 26 October 2026. 3 vulnerabilities in the last four weeks, down 67% on the four before (9). ## Counts - Last 7 days: 0 - Last 30 days: 3 - Last 90 days: 13 - All time: 26 (0 critical, 0 exploited in the wild) ## About tornado (PyPI) A Python web framework and asynchronous networking library designed to handle long-lived connections. ## Latest tornado (PyPI) vulnerabilities - [CVE-2026-116578: Tornado open redirect in RedirectHandler URL templates](https://junglewise.ai/threats/cve-2026-116578-tornado-is-a-python-web-framework-and-asynchronous-networking) (medium, CVSS 4, published 26 Oct 2026) - [CVE-2026-116577: Tornado HTTP header parser quadratic CPU consumption via line folding](https://junglewise.ai/threats/cve-2026-116577-tornado-is-a-python-web-framework-and-asynchronous-networking) (medium, CVSS 5.3, published 26 Oct 2026) - [CVE-2026-115927: Tornado HTTP/1.1 chunked encoding denial of service](https://junglewise.ai/threats/cve-2026-115927-tornado-is-a-python-web-framework-and-asynchronous-networking) (medium, CVSS 5.3, published 26 Oct 2026) - [CVE-2026-103263: Tornado StaticFileHandler path traversal via symlinks](https://junglewise.ai/threats/cve-2026-103263-tornado-staticfilehandler-follows-symlinks-outside-static-root) (medium, CVSS 5.9, published 1 Oct 2026) - [CVE-2026-103262: Tornado CurlAsyncHTTPClient unbounded memory accumulation in decompression](https://junglewise.ai/threats/cve-2026-103262-tornado-curlasynchttpclient-enforces-no-response-size-limit) (high, CVSS 7.5, published 1 Oct 2026) - [CVE-2026-103261: Tornado unbounded query string field parsing DoS](https://junglewise.ai/threats/cve-2026-103261-tornado-unbounded-query-string-argument-count-allows-event-loop) (medium, CVSS 5.3, published 1 Oct 2026) - [CVE-2026-91992: Tornado CurlAsyncHTTPClient credential leak via handle reuse](https://junglewise.ai/threats/cve-2026-91992-tornado-curlasynchttpclient-credential-leak-via-handle-reuse) (medium, CVSS 5.9, published 15 Sep 2026) - [CVE-2026-91991: Tornado cookie attribute injection via capitalized kwargs](https://junglewise.ai/threats/cve-2026-91991-tornado-cookie-attribute-injection-via-capitalized-kwargs) (medium, CVSS 5.4, published 15 Sep 2026) - [CVE-2026-91990: Tornado memory amplification vulnerability in multipart form parsing](https://junglewise.ai/threats/cve-2026-91990-tornado-memory-amplification-vulnerability-in-multipart-form) (high, CVSS 7.5, published 15 Sep 2026) - [CVE-2024-58384: Tornado CurlAsyncHTTPClient CRLF injection in request headers](https://junglewise.ai/threats/cve-2024-58384-tornado-curlasynchttpclient-crlf-injection-in-request-headers) (medium, CVSS 5.4, published 15 Sep 2026) - [CVE-2024-14029: Tornado HTTP request smuggling via duplicate Transfer-Encoding headers](https://junglewise.ai/threats/cve-2024-14029-tornado-http-request-smuggling-via-duplicate-transfer-encoding) (high, CVSS 7.5, published 15 Sep 2026) - [CVE-2023-54397: Tornado HTTP request smuggling in Content-Length parsing](https://junglewise.ai/threats/cve-2023-54397-tornado-http-request-smuggling-in-content-length-parsing) (high, CVSS 7.5, published 15 Sep 2026) - [CVE-2026-82397: Tornado urlencoded body parsing DoS via unbounded fields](https://junglewise.ai/threats/cve-2026-82397-tornado-urlencoded-body-parsing-dos-via-unbounded-fields) (high, CVSS 7.5, published 31 Aug 2026) - [CVE-2026-49855: Tornado memory exhaustion via gzip decompression amplification](https://junglewise.ai/threats/cve-2026-49855-tornado-memory-exhaustion-via-gzip-decompression-amplification) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-49854: Tornadoweb Tornado buffer over-read in tornado.speedups extension](https://junglewise.ai/threats/cve-2026-49854-tornadoweb-tornado-buffer-over-read-in-tornado-speedups-extension) (medium, CVSS 5.3, published 14 Jul 2026) - [CVE-2026-49853: Tornado SimpleAsyncHTTPClient sensitive header exposure in redirects](https://junglewise.ai/threats/cve-2026-49853-tornado-simpleasynchttpclient-sensitive-header-exposure-in) (high, CVSS 7.7, published 14 Jul 2026) - [CVE-2025-47287: PYSEC-2026-1974 - Tornado vulnerable to excessive logging caused by malformed multipart form data](https://junglewise.ai/threats/cve-2025-47287-tornado-vulnerable-to-excessive-logging-caused-by-malformed) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-52804: PYSEC-2026-1975 - Tornado has an HTTP cookie parsing DoS vulnerability](https://junglewise.ai/threats/cve-2024-52804-tornado-has-an-http-cookie-parsing-dos-vulnerability) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2026-35536: Tornado cookie attribute injection in RequestHandler.set_cookie](https://junglewise.ai/threats/cve-2026-35536-tornado-cookie-attribute-injection-in-requesthandler-set-cookie) (high, CVSS 7.2, published 3 Apr 2026) - [CVE-2026-31958: Tornado denial of service in multipart form parsing](https://junglewise.ai/threats/cve-2026-31958-tornado-denial-of-service-in-multipart-form-parsing) (high, CVSS 7.5, published 12 Mar 2026) - [CVE-2025-67726: Tornado quadratic DoS in httputil _parseparam](https://junglewise.ai/threats/cve-2025-67726-tornado-quadratic-dos-in-httputil-parseparam) (high, CVSS 7.5, published 12 Dec 2025) - [CVE-2025-67725: Tornado quadratic DoS via repeated header coalescing](https://junglewise.ai/threats/cve-2025-67725-tornado-quadratic-dos-via-repeated-header-coalescing) (high, CVSS 7.5, published 12 Dec 2025) - [CVE-2025-67724: Tornado header injection and XSS in reason argument](https://junglewise.ai/threats/cve-2025-67724-tornado-header-injection-and-xss-in-reason-argument) (medium, CVSS 5.4, published 12 Dec 2025) - [CVE-2023-28370: Open redirect in Tornado](https://junglewise.ai/threats/cve-2023-28370-open-redirect-in-tornado) (low, CVSS 3.1, published 25 May 2023) - [CVE-2014-9720: Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)](https://junglewise.ai/threats/cve-2014-9720-tornado-xsrf-cookie-allows-side-channel-attack-against-tls-breach) (low, CVSS 3.1, published 24 Jan 2020) ## Most severe tornado (PyPI) vulnerabilities - [CVE-2026-49853: Tornado SimpleAsyncHTTPClient sensitive header exposure in redirects](https://junglewise.ai/threats/cve-2026-49853-tornado-simpleasynchttpclient-sensitive-header-exposure-in) (high, CVSS 7.7, published 14 Jul 2026) - [CVE-2026-82397: Tornado urlencoded body parsing DoS via unbounded fields](https://junglewise.ai/threats/cve-2026-82397-tornado-urlencoded-body-parsing-dos-via-unbounded-fields) (high, CVSS 7.5, published 31 Aug 2026) - [CVE-2026-49855: Tornado memory exhaustion via gzip decompression amplification](https://junglewise.ai/threats/cve-2026-49855-tornado-memory-exhaustion-via-gzip-decompression-amplification) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2025-67725: Tornado quadratic DoS via repeated header coalescing](https://junglewise.ai/threats/cve-2025-67725-tornado-quadratic-dos-via-repeated-header-coalescing) (high, CVSS 7.5, published 12 Dec 2025) - [CVE-2025-67726: Tornado quadratic DoS in httputil _parseparam](https://junglewise.ai/threats/cve-2025-67726-tornado-quadratic-dos-in-httputil-parseparam) (high, CVSS 7.5, published 12 Dec 2025) - [CVE-2026-103262: Tornado CurlAsyncHTTPClient unbounded memory accumulation in decompression](https://junglewise.ai/threats/cve-2026-103262-tornado-curlasynchttpclient-enforces-no-response-size-limit) (high, CVSS 7.5, published 1 Oct 2026) - [CVE-2026-91990: Tornado memory amplification vulnerability in multipart form parsing](https://junglewise.ai/threats/cve-2026-91990-tornado-memory-amplification-vulnerability-in-multipart-form) (high, CVSS 7.5, published 15 Sep 2026) - [CVE-2026-31958: Tornado denial of service in multipart form parsing](https://junglewise.ai/threats/cve-2026-31958-tornado-denial-of-service-in-multipart-form-parsing) (high, CVSS 7.5, published 12 Mar 2026) - [CVE-2023-54397: Tornado HTTP request smuggling in Content-Length parsing](https://junglewise.ai/threats/cve-2023-54397-tornado-http-request-smuggling-in-content-length-parsing) (high, CVSS 7.5, published 15 Sep 2026) - [CVE-2024-14029: Tornado HTTP request smuggling via duplicate Transfer-Encoding headers](https://junglewise.ai/threats/cve-2024-14029-tornado-http-request-smuggling-via-duplicate-transfer-encoding) (high, CVSS 7.5, published 15 Sep 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, down 67% on the four before (9). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 6 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 3 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other PyPI technologies - [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities - [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities - [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities - [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities - [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities - [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities - [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities - [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities - [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities - [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities - [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities - [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "tornado (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/tornado, 13 November 2026.