# Tornadoweb vulnerabilities Source: https://junglewise.ai/threats/vendors/tornadoweb Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/tornadoweb.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 10 vulnerabilities in Tornadoweb: 1 in the last 7 days and 2 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123534, was published on 8 November 2026. 1 vulnerability in the last four weeks, up from none in the four before. 1 technology has a page of its own. ## Counts - Last 7 days: 1 - Last 30 days: 1 - Last 90 days: 2 - All time: 10 (0 critical, 0 exploited in the wild) ## About Tornadoweb Tornado is an open-source Python web framework and asynchronous networking library. ## Latest Tornadoweb vulnerabilities - [CVE-2026-123534: Tornado path traversal in static_url() and get_version()](https://junglewise.ai/threats/cve-2026-123534-tornado-before-6-6-contains-a-path-traversal-vulnerability-in) (medium, CVSS 6.5, published 8 Nov 2026) - [CVE-2026-82397: Tornado urlencoded body parsing DoS via unbounded fields](https://junglewise.ai/threats/cve-2026-82397-tornado-urlencoded-body-parsing-dos-via-unbounded-fields) (high, CVSS 7.5, published 31 Aug 2026) - [CVE-2026-49855: Tornado memory exhaustion via gzip decompression amplification](https://junglewise.ai/threats/cve-2026-49855-tornado-memory-exhaustion-via-gzip-decompression-amplification) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-49854: Tornadoweb Tornado buffer over-read in tornado.speedups extension](https://junglewise.ai/threats/cve-2026-49854-tornadoweb-tornado-buffer-over-read-in-tornado-speedups-extension) (medium, CVSS 5.3, published 14 Jul 2026) - [CVE-2026-49853: Tornado SimpleAsyncHTTPClient sensitive header exposure in redirects](https://junglewise.ai/threats/cve-2026-49853-tornado-simpleasynchttpclient-sensitive-header-exposure-in) (high, CVSS 7.7, published 14 Jul 2026) - [CVE-2026-35536: Tornado cookie attribute injection in RequestHandler.set_cookie](https://junglewise.ai/threats/cve-2026-35536-tornado-cookie-attribute-injection-in-requesthandler-set-cookie) (high, CVSS 7.2, published 3 Apr 2026) - [CVE-2026-31958: Tornado denial of service in multipart form parsing](https://junglewise.ai/threats/cve-2026-31958-tornado-denial-of-service-in-multipart-form-parsing) (high, CVSS 7.5, published 12 Mar 2026) - [CVE-2025-67726: Tornado quadratic DoS in httputil _parseparam](https://junglewise.ai/threats/cve-2025-67726-tornado-quadratic-dos-in-httputil-parseparam) (high, CVSS 7.5, published 12 Dec 2025) - [CVE-2025-67725: Tornado quadratic DoS via repeated header coalescing](https://junglewise.ai/threats/cve-2025-67725-tornado-quadratic-dos-via-repeated-header-coalescing) (high, CVSS 7.5, published 12 Dec 2025) - [CVE-2025-67724: Tornado header injection and XSS in reason argument](https://junglewise.ai/threats/cve-2025-67724-tornado-header-injection-and-xss-in-reason-argument) (medium, CVSS 5.4, published 12 Dec 2025) ## Most severe Tornadoweb vulnerabilities - [CVE-2026-49853: Tornado SimpleAsyncHTTPClient sensitive header exposure in redirects](https://junglewise.ai/threats/cve-2026-49853-tornado-simpleasynchttpclient-sensitive-header-exposure-in) (high, CVSS 7.7, published 14 Jul 2026) - [CVE-2026-82397: Tornado urlencoded body parsing DoS via unbounded fields](https://junglewise.ai/threats/cve-2026-82397-tornado-urlencoded-body-parsing-dos-via-unbounded-fields) (high, CVSS 7.5, published 31 Aug 2026) - [CVE-2026-49855: Tornado memory exhaustion via gzip decompression amplification](https://junglewise.ai/threats/cve-2026-49855-tornado-memory-exhaustion-via-gzip-decompression-amplification) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2025-67725: Tornado quadratic DoS via repeated header coalescing](https://junglewise.ai/threats/cve-2025-67725-tornado-quadratic-dos-via-repeated-header-coalescing) (high, CVSS 7.5, published 12 Dec 2025) - [CVE-2025-67726: Tornado quadratic DoS in httputil _parseparam](https://junglewise.ai/threats/cve-2025-67726-tornado-quadratic-dos-in-httputil-parseparam) (high, CVSS 7.5, published 12 Dec 2025) - [CVE-2026-31958: Tornado denial of service in multipart form parsing](https://junglewise.ai/threats/cve-2026-31958-tornado-denial-of-service-in-multipart-form-parsing) (high, CVSS 7.5, published 12 Mar 2026) - [CVE-2026-35536: Tornado cookie attribute injection in RequestHandler.set_cookie](https://junglewise.ai/threats/cve-2026-35536-tornado-cookie-attribute-injection-in-requesthandler-set-cookie) (high, CVSS 7.2, published 3 Apr 2026) - [CVE-2026-123534: Tornado path traversal in static_url() and get_version()](https://junglewise.ai/threats/cve-2026-123534-tornado-before-6-6-contains-a-path-traversal-vulnerability-in) (medium, CVSS 6.5, published 8 Nov 2026) - [CVE-2025-67724: Tornado header injection and XSS in reason argument](https://junglewise.ai/threats/cve-2025-67724-tornado-header-injection-and-xss-in-reason-argument) (medium, CVSS 5.4, published 12 Dec 2025) - [CVE-2026-49854: Tornadoweb Tornado buffer over-read in tornado.speedups extension](https://junglewise.ai/threats/cve-2026-49854-tornadoweb-tornado-buffer-over-read-in-tornado-speedups-extension) (medium, CVSS 5.3, published 14 Jul 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Tornadoweb technologies - [Tornadoweb Tornado](https://junglewise.ai/threats/technologies/tornadoweb-tornado): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Tornadoweb vulnerabilities", https://junglewise.ai/threats/vendors/tornadoweb, 9 November 2026.