{"schema_version":1,"title":"Tornadoweb vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 10 vulnerabilities in Tornadoweb: 1 in the last 7 days and 2 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123534, was published on 8 November 2026. 1 vulnerability in the last four weeks, up from none in the four before. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/tornadoweb","json_url":"https://junglewise.ai/threats/vendors/tornadoweb.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/tornadoweb","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":7,"all_time":10,"critical":0,"exploited":0,"last_7_days":1,"last_30_days":1,"last_90_days":2,"last_365_days":10},"latest":[{"cve":"CVE-2026-123534","cvss":6.5,"slug":"cve-2026-123534-tornado-before-6-6-contains-a-path-traversal-vulnerability-in","title":"Tornado path traversal in static_url() and get_version()","severity":"medium","exploited":false,"published_at":"2026-11-08T02:16:43.727+00:00","url":"https://junglewise.ai/threats/cve-2026-123534-tornado-before-6-6-contains-a-path-traversal-vulnerability-in"},{"cve":"CVE-2026-82397","cvss":7.5,"epss":0.0063,"slug":"cve-2026-82397-tornado-urlencoded-body-parsing-dos-via-unbounded-fields","title":"Tornado urlencoded body parsing DoS via unbounded fields","severity":"high","exploited":false,"published_at":"2026-08-31T22:17:22.92+00:00","url":"https://junglewise.ai/threats/cve-2026-82397-tornado-urlencoded-body-parsing-dos-via-unbounded-fields"},{"cve":"CVE-2026-49855","cvss":7.5,"epss":0.0061,"slug":"cve-2026-49855-tornado-memory-exhaustion-via-gzip-decompression-amplification","title":"Tornado memory exhaustion via gzip decompression amplification","severity":"high","exploited":false,"published_at":"2026-07-14T21:17:02.437+00:00","url":"https://junglewise.ai/threats/cve-2026-49855-tornado-memory-exhaustion-via-gzip-decompression-amplification"},{"cve":"CVE-2026-49854","cvss":5.3,"epss":0.0042,"slug":"cve-2026-49854-tornadoweb-tornado-buffer-over-read-in-tornado-speedups-extension","title":"Tornadoweb Tornado buffer over-read in tornado.speedups extension","severity":"medium","exploited":false,"published_at":"2026-07-14T21:17:02.3+00:00","url":"https://junglewise.ai/threats/cve-2026-49854-tornadoweb-tornado-buffer-over-read-in-tornado-speedups-extension"},{"cve":"CVE-2026-49853","cvss":7.7,"epss":0.0045,"slug":"cve-2026-49853-tornado-simpleasynchttpclient-sensitive-header-exposure-in","title":"Tornado SimpleAsyncHTTPClient sensitive header exposure in redirects","severity":"high","exploited":false,"published_at":"2026-07-14T21:17:02.13+00:00","url":"https://junglewise.ai/threats/cve-2026-49853-tornado-simpleasynchttpclient-sensitive-header-exposure-in"},{"cve":"CVE-2026-35536","cvss":7.2,"epss":0.0029,"slug":"cve-2026-35536-tornado-cookie-attribute-injection-in-requesthandler-set-cookie","title":"Tornado cookie attribute injection in RequestHandler.set_cookie","severity":"high","exploited":false,"published_at":"2026-04-03T04:16:53.55+00:00","url":"https://junglewise.ai/threats/cve-2026-35536-tornado-cookie-attribute-injection-in-requesthandler-set-cookie"},{"cve":"CVE-2026-31958","cvss":7.5,"epss":0.0049,"slug":"cve-2026-31958-tornado-denial-of-service-in-multipart-form-parsing","title":"Tornado denial of service in multipart form parsing","severity":"high","exploited":false,"published_at":"2026-03-12T14:19:52+00:00","url":"https://junglewise.ai/threats/cve-2026-31958-tornado-denial-of-service-in-multipart-form-parsing"},{"cve":"CVE-2025-67726","cvss":7.5,"epss":0.0054,"slug":"cve-2025-67726-tornado-quadratic-dos-in-httputil-parseparam","title":"Tornado quadratic DoS in httputil _parseparam","severity":"high","exploited":false,"published_at":"2025-12-12T07:15:44.92+00:00","url":"https://junglewise.ai/threats/cve-2025-67726-tornado-quadratic-dos-in-httputil-parseparam"},{"cve":"CVE-2025-67725","cvss":7.5,"epss":0.0056,"slug":"cve-2025-67725-tornado-quadratic-dos-via-repeated-header-coalescing","title":"Tornado quadratic DoS via repeated header coalescing","severity":"high","exploited":false,"published_at":"2025-12-12T06:15:41.38+00:00","url":"https://junglewise.ai/threats/cve-2025-67725-tornado-quadratic-dos-via-repeated-header-coalescing"},{"cve":"CVE-2025-67724","cvss":5.4,"epss":0.0024,"slug":"cve-2025-67724-tornado-header-injection-and-xss-in-reason-argument","title":"Tornado header injection and XSS in reason argument","severity":"medium","exploited":false,"published_at":"2025-12-12T06:15:41.213+00:00","url":"https://junglewise.ai/threats/cve-2025-67724-tornado-header-injection-and-xss-in-reason-argument"}],"vendor":{"hub":true,"name":"Tornadoweb","slug":"tornadoweb","homepage":"https://www.tornadoweb.org/","description":"Tornado is an open-source Python web framework and asynchronous networking library.","url":"https://junglewise.ai/threats/vendors/tornadoweb"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-49853","cvss":7.7,"epss":0.0045,"slug":"cve-2026-49853-tornado-simpleasynchttpclient-sensitive-header-exposure-in","title":"Tornado SimpleAsyncHTTPClient sensitive header exposure in redirects","severity":"high","exploited":false,"published_at":"2026-07-14T21:17:02.13+00:00","url":"https://junglewise.ai/threats/cve-2026-49853-tornado-simpleasynchttpclient-sensitive-header-exposure-in"},{"cve":"CVE-2026-82397","cvss":7.5,"epss":0.0063,"slug":"cve-2026-82397-tornado-urlencoded-body-parsing-dos-via-unbounded-fields","title":"Tornado urlencoded body parsing DoS via unbounded fields","severity":"high","exploited":false,"published_at":"2026-08-31T22:17:22.92+00:00","url":"https://junglewise.ai/threats/cve-2026-82397-tornado-urlencoded-body-parsing-dos-via-unbounded-fields"},{"cve":"CVE-2026-49855","cvss":7.5,"epss":0.0061,"slug":"cve-2026-49855-tornado-memory-exhaustion-via-gzip-decompression-amplification","title":"Tornado memory exhaustion via gzip decompression amplification","severity":"high","exploited":false,"published_at":"2026-07-14T21:17:02.437+00:00","url":"https://junglewise.ai/threats/cve-2026-49855-tornado-memory-exhaustion-via-gzip-decompression-amplification"},{"cve":"CVE-2025-67725","cvss":7.5,"epss":0.0056,"slug":"cve-2025-67725-tornado-quadratic-dos-via-repeated-header-coalescing","title":"Tornado quadratic DoS via repeated header coalescing","severity":"high","exploited":false,"published_at":"2025-12-12T06:15:41.38+00:00","url":"https://junglewise.ai/threats/cve-2025-67725-tornado-quadratic-dos-via-repeated-header-coalescing"},{"cve":"CVE-2025-67726","cvss":7.5,"epss":0.0054,"slug":"cve-2025-67726-tornado-quadratic-dos-in-httputil-parseparam","title":"Tornado quadratic DoS in httputil _parseparam","severity":"high","exploited":false,"published_at":"2025-12-12T07:15:44.92+00:00","url":"https://junglewise.ai/threats/cve-2025-67726-tornado-quadratic-dos-in-httputil-parseparam"},{"cve":"CVE-2026-31958","cvss":7.5,"epss":0.0049,"slug":"cve-2026-31958-tornado-denial-of-service-in-multipart-form-parsing","title":"Tornado denial of service in multipart form parsing","severity":"high","exploited":false,"published_at":"2026-03-12T14:19:52+00:00","url":"https://junglewise.ai/threats/cve-2026-31958-tornado-denial-of-service-in-multipart-form-parsing"},{"cve":"CVE-2026-35536","cvss":7.2,"epss":0.0029,"slug":"cve-2026-35536-tornado-cookie-attribute-injection-in-requesthandler-set-cookie","title":"Tornado cookie attribute injection in RequestHandler.set_cookie","severity":"high","exploited":false,"published_at":"2026-04-03T04:16:53.55+00:00","url":"https://junglewise.ai/threats/cve-2026-35536-tornado-cookie-attribute-injection-in-requesthandler-set-cookie"},{"cve":"CVE-2026-123534","cvss":6.5,"slug":"cve-2026-123534-tornado-before-6-6-contains-a-path-traversal-vulnerability-in","title":"Tornado path traversal in static_url() and get_version()","severity":"medium","exploited":false,"published_at":"2026-11-08T02:16:43.727+00:00","url":"https://junglewise.ai/threats/cve-2026-123534-tornado-before-6-6-contains-a-path-traversal-vulnerability-in"},{"cve":"CVE-2025-67724","cvss":5.4,"epss":0.0024,"slug":"cve-2025-67724-tornado-header-injection-and-xss-in-reason-argument","title":"Tornado header injection and XSS in reason argument","severity":"medium","exploited":false,"published_at":"2025-12-12T06:15:41.213+00:00","url":"https://junglewise.ai/threats/cve-2025-67724-tornado-header-injection-and-xss-in-reason-argument"},{"cve":"CVE-2026-49854","cvss":5.3,"epss":0.0042,"slug":"cve-2026-49854-tornadoweb-tornado-buffer-over-read-in-tornado-speedups-extension","title":"Tornadoweb Tornado buffer over-read in tornado.speedups extension","severity":"medium","exploited":false,"published_at":"2026-07-14T21:17:02.3+00:00","url":"https://junglewise.ai/threats/cve-2026-49854-tornadoweb-tornado-buffer-over-read-in-tornado-speedups-extension"}],"generated_at":"2026-11-09T03:07:00.176479+00:00","technologies":[{"name":"Tornadoweb Tornado","slug":"tornadoweb-tornado","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/tornadoweb-tornado"}]}