Skip to content
Threat Feed
Subscribe

Vendor

Tornado

3 briefs RSS
high advisory

Tornado StaticFileHandler Symlink Path Traversal

A path traversal vulnerability in Tornado's StaticFileHandler allows unauthenticated remote attackers to read arbitrary files via symbolic links within the static root directory.

Tornado path-traversal web-application python
2t
high advisory

HTTP Request Smuggling Vulnerability in Tornado

Tornado versions prior to 6.4.1 are vulnerable to HTTP request smuggling via the improper processing of duplicate 'Transfer-Encoding: chunked' headers when deployed behind a proxy.

Tornado +1 web-application http-request-smuggling vulnerability request-smuggling
3t 1c updated
low advisory

Denial of Service in Tornado via Unbounded Form Field Parsing

Tornado fails to restrict the number of fields parsed in application/x-www-form-urlencoded request bodies, allowing an unauthenticated attacker to cause a denial-of-service by stalling the event loop.

Tornado denial-of-service web-application vulnerability
1t 1c