1099 matches found
SUSE-SU-2026:3160-1 Security update for python-tornado
This update for python-tornado fixes the following issues: - GHSA-pw6j-qg29-8w7f: CurlAsyncHTTPClient leaks per-request credentials on handle reuse bsc1269012...
SUSE-SU-2026:3155-1 Security update for python-tornado6
This update for python-tornado6 fixes the following issue - GHSA-pw6j-qg29-8w7f: CurlAsyncHTTPClient leaks per-request credentials on handle reuse bsc1269012...
EUVD-2025-203029
Tornado: Quadratic DoS via Crafted Multipart Parameters...
Tornado: Quadratic DoS via Crafted Multipart Parameters
Summary The parseparam function in Tornado's httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data. This function uses an inefficient algorithm that repeatedly calls string.count within a nested loop while processing quoted semicolons e.g., param=";". As a...
GHSA-JHMP-MQWM-3GQ8 Tornado: Quadratic DoS via Crafted Multipart Parameters
Summary The parseparam function in Tornado's httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data. This function uses an inefficient algorithm that repeatedly calls string.count within a nested loop while processing quoted semicolons e.g., param=";". As a...
GHSA-C98P-7WGM-6P64 Tornado: Quadratic DoS via Repeated Header Coalescing
Summary The HTTPHeaders.add method in Tornado accumulates values using string concatenation when the same header name is repeated. Due to Python string immutability, each concatenation copies the entire string, resulting in On² time complexity. Given Tornado's single event loop architecture, a...
Tornado: Quadratic DoS via Repeated Header Coalescing
Summary The HTTPHeaders.add method in Tornado accumulates values using string concatenation when the same header name is repeated. Due to Python string immutability, each concatenation copies the entire string, resulting in On² time complexity. Given Tornado's single event loop architecture, a...
EUVD-2025-203031
Tornado: Quadratic DoS via Repeated Header Coalescing...
EUVD-2025-203032
Tornado vulnerable to Header Injection and XSS via reason argument...
Tornado vulnerable to Header Injection and XSS via reason argument
Header injection and XSS via reason argument Summary The reason argument used by both RequestHandler.setstatus and tornado.web.HTTPError is designed to allow applications to pass custom "reason" phrases the "Not Found" in HTTP/1.1 404 Not Found to the HTTP status line mainly for non-standard stat...
GHSA-PR2V-JX2C-WG9F Tornado vulnerable to Header Injection and XSS via reason argument
Header injection and XSS via reason argument Summary The reason argument used by both RequestHandler.setstatus and tornado.web.HTTPError is designed to allow applications to pass custom "reason" phrases the "Not Found" in HTTP/1.1 404 Not Found to the HTTP status line mainly for non-standard stat...
Linux Distros Unpatched Vulnerability : CVE-2026-49853
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only...
ROOT-APP-PYPI-CVE-2026-35536 CVE-2026-35536 in rootio-tornado - Patched by Root
Root has patched CVE-2026-35536 in the rootio-tornado package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-753J-MPMX-QQ6G GHSA-753j-mpmx-qq6g in rootio-tornado - Patched by Root
Root has patched GHSA-753j-mpmx-qq6g in the rootio-tornado package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-31958 CVE-2026-31958 in rootio-tornado - Patched by Root
Root has patched CVE-2026-31958 in the rootio-tornado package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2023-28370 CVE-2023-28370 in rootio-tornado - Patched by Root
Root has patched CVE-2023-28370 in the rootio-tornado package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-78CV-MQJ4-43F7 GHSA-78cv-mqj4-43f7 in rootio-tornado - Patched by Root
Root has patched GHSA-78cv-mqj4-43f7 in the rootio-tornado package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2025-47287 CVE-2025-47287 in rootio-tornado - Patched by Root
Root has patched CVE-2025-47287 in the rootio-tornado package for Root:PyPI. Multiple fixed versions available...