Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:*

2 briefs RSS
high advisory

HTTP Request Smuggling Vulnerability in Tornado

Tornado versions prior to 6.4.1 are vulnerable to HTTP request smuggling via the improper processing of duplicate 'Transfer-Encoding: chunked' headers when deployed behind a proxy.

Tornado +1 web-application http-request-smuggling vulnerability request-smuggling
3t 1c updated
low advisory

Tornado Quadratic DoS via Repeated HTTP Header Coalescing (CVE-2025-67725)

A quadratic Denial of Service (DoS) vulnerability exists in Tornado's `HTTPHeaders.add` method due to inefficient string concatenation for repeated header names, which, when processing a maliciously crafted HTTP request with numerous repeated headers, can block the server's single event loop for an extended period, leading to a high severity DoS if `max_header_size` is increased from its default 64KB.

Tornado denial-of-service web-vulnerability python
1t 1c