p PatchFirst

PatchFirst · Latest vulnerabilities

python-tornado vulnerabilities

Vulnerability published for python-tornado in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 8

  1. SUSE-SU-2026:4404-1

    Not ratedFix available

    Security update for python-tornado

    This update for python-tornado fixes the following issues: - CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At (bsc#1280689). - CVE-2024-58384: CRLF injection in CurlAsyncHTTPClient headers (bsc#1281059). - CVE-2026-91990: splitting of multipart data before validation of the `max_parts` limit allows for resource exhaustion and a denial of service (bsc#1281439). - CVE-2026-91991: incomplete fix for cookie attribute injection allows for cookie validation bypass via semicolon- delimited data in capitalized parameters

    python-tornadoOperating systems
    • Update to 4.5.3-150000.3.31.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. SUSE-SU-2026:4073-1

    Not ratedFix available

    Security update for python-tornado

    This update for python-tornado fixes the following issue: - CVE-2026-82397: an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection (bsc#1277725).

    python-tornadoOperating systems
    • Update to 4.5.3-150000.3.28.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. SUSE-SU-2026:2726-1

    Not ratedFix available

    Security update for python-tornado

    This update for python-tornado fixes the following issues - CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395). - CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396). - CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).

    python-tornadoOperating systems
    • Update to 4.5.3-150000.3.22.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. SUSE-SU-2026:1171-1

    Not ratedFix available

    Security update for python-tornado

    This update for python-tornado fixes the following issues: - CVE-2026-31958: parsing large multipart bodies with many parts can cause a denial of service (bsc#1259553). - incomplete validation of cookie attributes allows for injection of user-controlled values in other cookie attributes (bsc#1259630).

    python-tornadoOperating systems
    • Update to 4.5.3-150000.3.19.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  7. SUSE-SU-2026:0222-1

    Not ratedFix available

    Security update for python-tornado

    This update for python-tornado fixes the following issues: - CVE-2025-67725: inefficient algorithm when parsing parameters for HTTP header values (bsc#1254905). - CVE-2025-67726: Denial of Service (DoS) via maliciously crafted HTTP request caused by the HTTPHeaders.add method (bsc#1254904).

    python-tornadoOperating systems
    • Update to 4.5.3-150000.3.13.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →