tornado

tornado anonymously reverse shell over onion network using hidden services without portfortwarding Explore the docs fully undetectable reverse shell · View Demo · bulletproof anonymity Table of Contents 1. What is tornado? 2. Built With 3. Getting Started Installation 4. Usage 5. Roadmap 6...

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop and therefore every other connection serve...

GHSA-R4J5-9XPP-3985 Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks

Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop and therefore every other connection serve...

EUVD-2026-110077

Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks...

GHSA-PW9P-V7R6-GX4P Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Summary tornado.web.RedirectHandler builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the...

EUVD-2026-110319

Tornado: Open redirect in RedirectHandler via protocol-relative URLs...

Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Summary tornado.web.RedirectHandler builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the...

Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

Summary Tornado's HTTP header parser takes quadratic time On² when a header value is continued across many "obsolete line folding" obs-fold lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the...

EUVD-2026-110318

Tornado: Quadratic CPU usage when parsing HTTP headers with line folding...

GHSA-PCG2-G6CJ-Q92C Tornado: Quadratic CPU usage when parsing HTTP headers with line folding

Summary Tornado's HTTP header parser takes quadratic time On² when a header value is continued across many "obsolete line folding" obs-fold lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a large amount of CPU on the...

Important: Red Hat Security Advisory: python-tornado security update

An update for python-tornado is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient

A flaw was found in Tornado. A remote malicious server can cause a Denial of Service DoS when an application using the CurlAsyncHTTPClient component fetches an untrusted web address. Because the client fails to enforce limits on incoming response sizes, the attacker can return a small, highly...

CVE-2026-115927

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...

CVE-2026-116577

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a head...

CVE-2026-116578

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start o...

Docmosis Tornado Unauthenticated Arbitrary File Write to Root RCE (storeTo=file: — Detect

Fingerprint / reachability check for Docmosis Tornado Unauthenticated Arbitrary File Write to Root RCE storeTo=file: → cron !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Docmosis Tornado Unauthenticated Arbitrary File Write to Root RCE storeTo=file: → cron""" from kittysploit import...

Docmosis Tornado storeTo file write cron RCE

Anonymous POST /api/render with storeTo=file:/etc/cron.d/... writes a cron line as root when the service runs with elevated privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Docmosis Tornado unauthenticated storeTo=file arbitrary write → cron root RCE.""" from future import annotations...

CVE-2026-116578

A flaw was found in Tornado. When an application configures RedirectHandler with dynamic URL templates, user-controlled input in request paths can alter the target redirect scheme or host location. A remote attacker can exploit this vulnerability by sending a crafted request to trigger an open...

CVE-2026-116577

A flaw was found in Tornado. An unauthenticated remote attacker can cause a Denial of Service DoS by sending crafted HTTP requests containing many folded header continuation lines. Processing these lines requires quadratic computational effort, consuming excessive CPU resources on the server's...

CVE-2026-115927

A flaw was found in Tornado. When decoding HTTP/1.1 chunked transfer encoding, Tornado processes received data without yielding control back to the event loop. A remote unauthenticated attacker can send requests containing a large volume of small chunks to monopolize the process and consume...