{"schema_version":1,"title":"Tornado vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 10 vulnerabilities in Tornado: 1 in the last 7 days and 10 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123535, was published on 8 November 2026. 2 vulnerabilities in the last four weeks, down 75% on the four before (8). 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/tornado","json_url":"https://junglewise.ai/threats/vendors/tornado.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/tornado","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":4,"all_time":10,"critical":0,"exploited":0,"last_7_days":1,"last_30_days":2,"last_90_days":10,"last_365_days":10},"latest":[{"cve":"CVE-2026-123535","cvss":4.2,"slug":"cve-2026-123535-tornado-before-6-6-does-not-validate-the-max-age-argument-of","title":"Tornado cookie attribute injection in set_cookie max_age","severity":"medium","exploited":false,"published_at":"2026-11-08T02:16:43.917+00:00","url":"https://junglewise.ai/threats/cve-2026-123535-tornado-before-6-6-does-not-validate-the-max-age-argument-of"},{"cve":"CVE-2026-116577","cvss":5.3,"epss":0.0038,"slug":"cve-2026-116577-tornado-is-a-python-web-framework-and-asynchronous-networking","title":"Tornado HTTP header parser quadratic CPU consumption via line folding","severity":"medium","exploited":false,"published_at":"2026-10-26T21:18:14.087+00:00","url":"https://junglewise.ai/threats/cve-2026-116577-tornado-is-a-python-web-framework-and-asynchronous-networking"},{"cve":"CVE-2026-103262","cvss":7.5,"epss":0.0053,"slug":"cve-2026-103262-tornado-curlasynchttpclient-enforces-no-response-size-limit","title":"Tornado CurlAsyncHTTPClient unbounded memory accumulation in decompression","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:21.05+00:00","url":"https://junglewise.ai/threats/cve-2026-103262-tornado-curlasynchttpclient-enforces-no-response-size-limit"},{"cve":"CVE-2026-103261","cvss":5.3,"epss":0.0047,"slug":"cve-2026-103261-tornado-unbounded-query-string-argument-count-allows-event-loop","title":"Tornado unbounded query string field parsing DoS","severity":"medium","exploited":false,"published_at":"2026-10-01T11:17:20.847+00:00","url":"https://junglewise.ai/threats/cve-2026-103261-tornado-unbounded-query-string-argument-count-allows-event-loop"},{"cve":"CVE-2026-91992","cvss":5.9,"epss":0.0026,"slug":"cve-2026-91992-tornado-curlasynchttpclient-credential-leak-via-handle-reuse","title":"Tornado CurlAsyncHTTPClient credential leak via handle reuse","severity":"medium","exploited":false,"published_at":"2026-09-15T16:17:58.447+00:00","url":"https://junglewise.ai/threats/cve-2026-91992-tornado-curlasynchttpclient-credential-leak-via-handle-reuse"},{"cve":"CVE-2026-91991","cvss":5.4,"epss":0.0028,"slug":"cve-2026-91991-tornado-cookie-attribute-injection-via-capitalized-kwargs","title":"Tornado cookie attribute injection via capitalized kwargs","severity":"medium","exploited":false,"published_at":"2026-09-15T16:17:58.293+00:00","url":"https://junglewise.ai/threats/cve-2026-91991-tornado-cookie-attribute-injection-via-capitalized-kwargs"},{"cve":"CVE-2026-91990","cvss":7.5,"epss":0.0049,"slug":"cve-2026-91990-tornado-memory-amplification-vulnerability-in-multipart-form","title":"Tornado memory amplification vulnerability in multipart form parsing","severity":"high","exploited":false,"published_at":"2026-09-15T16:17:58.147+00:00","url":"https://junglewise.ai/threats/cve-2026-91990-tornado-memory-amplification-vulnerability-in-multipart-form"},{"cve":"CVE-2024-58384","cvss":5.4,"epss":0.0024,"slug":"cve-2024-58384-tornado-curlasynchttpclient-crlf-injection-in-request-headers","title":"Tornado CurlAsyncHTTPClient CRLF injection in request headers","severity":"medium","exploited":false,"published_at":"2026-09-15T16:17:07.053+00:00","url":"https://junglewise.ai/threats/cve-2024-58384-tornado-curlasynchttpclient-crlf-injection-in-request-headers"},{"cve":"CVE-2024-14029","cvss":7.5,"epss":0.0035,"slug":"cve-2024-14029-tornado-http-request-smuggling-via-duplicate-transfer-encoding","title":"Tornado HTTP request smuggling via duplicate Transfer-Encoding headers","severity":"high","exploited":false,"published_at":"2026-09-15T16:17:06.893+00:00","url":"https://junglewise.ai/threats/cve-2024-14029-tornado-http-request-smuggling-via-duplicate-transfer-encoding"},{"cve":"CVE-2023-54397","cvss":7.5,"epss":0.0037,"slug":"cve-2023-54397-tornado-http-request-smuggling-in-content-length-parsing","title":"Tornado HTTP request smuggling in Content-Length parsing","severity":"high","exploited":false,"published_at":"2026-09-15T16:17:05.777+00:00","url":"https://junglewise.ai/threats/cve-2023-54397-tornado-http-request-smuggling-in-content-length-parsing"}],"vendor":{"hub":true,"name":"Tornado","slug":"tornado","url":"https://junglewise.ai/threats/vendors/tornado"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-103262","cvss":7.5,"epss":0.0053,"slug":"cve-2026-103262-tornado-curlasynchttpclient-enforces-no-response-size-limit","title":"Tornado CurlAsyncHTTPClient unbounded memory accumulation in decompression","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:21.05+00:00","url":"https://junglewise.ai/threats/cve-2026-103262-tornado-curlasynchttpclient-enforces-no-response-size-limit"},{"cve":"CVE-2026-91990","cvss":7.5,"epss":0.0049,"slug":"cve-2026-91990-tornado-memory-amplification-vulnerability-in-multipart-form","title":"Tornado memory amplification vulnerability in multipart form parsing","severity":"high","exploited":false,"published_at":"2026-09-15T16:17:58.147+00:00","url":"https://junglewise.ai/threats/cve-2026-91990-tornado-memory-amplification-vulnerability-in-multipart-form"},{"cve":"CVE-2023-54397","cvss":7.5,"epss":0.0037,"slug":"cve-2023-54397-tornado-http-request-smuggling-in-content-length-parsing","title":"Tornado HTTP request smuggling in Content-Length parsing","severity":"high","exploited":false,"published_at":"2026-09-15T16:17:05.777+00:00","url":"https://junglewise.ai/threats/cve-2023-54397-tornado-http-request-smuggling-in-content-length-parsing"},{"cve":"CVE-2024-14029","cvss":7.5,"epss":0.0035,"slug":"cve-2024-14029-tornado-http-request-smuggling-via-duplicate-transfer-encoding","title":"Tornado HTTP request smuggling via duplicate Transfer-Encoding headers","severity":"high","exploited":false,"published_at":"2026-09-15T16:17:06.893+00:00","url":"https://junglewise.ai/threats/cve-2024-14029-tornado-http-request-smuggling-via-duplicate-transfer-encoding"},{"cve":"CVE-2026-91992","cvss":5.9,"epss":0.0026,"slug":"cve-2026-91992-tornado-curlasynchttpclient-credential-leak-via-handle-reuse","title":"Tornado CurlAsyncHTTPClient credential leak via handle reuse","severity":"medium","exploited":false,"published_at":"2026-09-15T16:17:58.447+00:00","url":"https://junglewise.ai/threats/cve-2026-91992-tornado-curlasynchttpclient-credential-leak-via-handle-reuse"},{"cve":"CVE-2026-91991","cvss":5.4,"epss":0.0028,"slug":"cve-2026-91991-tornado-cookie-attribute-injection-via-capitalized-kwargs","title":"Tornado cookie attribute injection via capitalized kwargs","severity":"medium","exploited":false,"published_at":"2026-09-15T16:17:58.293+00:00","url":"https://junglewise.ai/threats/cve-2026-91991-tornado-cookie-attribute-injection-via-capitalized-kwargs"},{"cve":"CVE-2024-58384","cvss":5.4,"epss":0.0024,"slug":"cve-2024-58384-tornado-curlasynchttpclient-crlf-injection-in-request-headers","title":"Tornado CurlAsyncHTTPClient CRLF injection in request headers","severity":"medium","exploited":false,"published_at":"2026-09-15T16:17:07.053+00:00","url":"https://junglewise.ai/threats/cve-2024-58384-tornado-curlasynchttpclient-crlf-injection-in-request-headers"},{"cve":"CVE-2026-103261","cvss":5.3,"epss":0.0047,"slug":"cve-2026-103261-tornado-unbounded-query-string-argument-count-allows-event-loop","title":"Tornado unbounded query string field parsing DoS","severity":"medium","exploited":false,"published_at":"2026-10-01T11:17:20.847+00:00","url":"https://junglewise.ai/threats/cve-2026-103261-tornado-unbounded-query-string-argument-count-allows-event-loop"},{"cve":"CVE-2026-116577","cvss":5.3,"epss":0.0038,"slug":"cve-2026-116577-tornado-is-a-python-web-framework-and-asynchronous-networking","title":"Tornado HTTP header parser quadratic CPU consumption via line folding","severity":"medium","exploited":false,"published_at":"2026-10-26T21:18:14.087+00:00","url":"https://junglewise.ai/threats/cve-2026-116577-tornado-is-a-python-web-framework-and-asynchronous-networking"},{"cve":"CVE-2026-123535","cvss":4.2,"slug":"cve-2026-123535-tornado-before-6-6-does-not-validate-the-max-age-argument-of","title":"Tornado cookie attribute injection in set_cookie max_age","severity":"medium","exploited":false,"published_at":"2026-11-08T02:16:43.917+00:00","url":"https://junglewise.ai/threats/cve-2026-123535-tornado-before-6-6-does-not-validate-the-max-age-argument-of"}],"generated_at":"2026-11-09T03:07:00.176479+00:00","technologies":[{"name":"Tornado","slug":"tornado-tornado","vulnerabilities":10,"url":"https://junglewise.ai/threats/technologies/tornado-tornado"}]}