Skip to content
Threat Feed
Subscribe

Tag

Tornado

2 briefs RSS
high advisory

Tornado StaticFileHandler Symlink Path Traversal

A path traversal vulnerability in Tornado's StaticFileHandler allows unauthenticated remote attackers to read arbitrary files via symbolic links within the static root directory.

Tornado path-traversal web-application python
2t
low advisory

Tornado Quadratic DoS via Repeated HTTP Header Coalescing (CVE-2025-67725)

A quadratic Denial of Service (DoS) vulnerability exists in Tornado's `HTTPHeaders.add` method due to inefficient string concatenation for repeated header names, which, when processing a maliciously crafted HTTP request with numerous repeated headers, can block the server's single event loop for an extended period, leading to a high severity DoS if `max_header_size` is increased from its default 64KB.

Tornado denial-of-service web-vulnerability python
1t 1c