python3Packages.tornado
tornado 6.5.7 · pkgs/development/python-modules/tornado/default.nix
Health
Risk
risk 74 critical
- +60 6 open advisories
- +8 an OSV advisory has a public exploit (CISA)
- +6 no maintainer
Version
6.5.7 no newer release known to repology
Channels
Hydra
succeeded 10y ago
Advisories
GHSA-3hv7-mjh2-fv65 medium 6.9 EPSS 0.5% Tornado: Unbounded query-string argument count allows event-loop-stalling DoS (OSV, for this version)
CVE-2026-103261
GHSA-8423-8fgw-73vq medium EPSS 0.4% tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34) (OSV, for this version)
CVE-2026-91990
GHSA-c2m8-h5v5-343r high 8.2 public exploit EPSS 0.5% Tornado: StaticFileHandler follows symlinks outside static root (path traversal) (OSV, for this version)
CVE-2026-103263
GHSA-chx6-46f5-w4vp high 8.7 public exploit tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM (OSV, for this version)
CVE-2026-103262
GHSA-mpf4-983q-p7j4 high EPSS 0.3% Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop (OSV, for this version)
CVE-2026-82397
GHSA-wwv5-g3v4-889x low EPSS 0.2% Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie` (OSV, for this version)
CVE-2026-91991
Packaging
not read yet: the next index sweep reads it
Maintainers
none
Pull requests 2
python3Packages.tornado: 6.5.7 → 6.5.10
#563949 by jpds · opened 4w ago · checks pass
ceph: add riscv64-linux support
#560645 by liberodark · opened 5w ago · checks pass
Issues 4
python3Packages.tornado: security issues < 6.5.9 1.severity: security
#569366 by nixpkgs-security-tracker · opened 2w ago · 0 comments
python3Packages.tornado: security issues < 6.5.8 1.severity: security
#563855 by nixpkgs-security-tracker · opened 4w ago · 0 comments
Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop 1.severity: security
#558816 by nixpkgs-security-tracker · opened 6w ago · 0 comments
Build failure: python3Packages.tornado 6.topic: python 2.status: stale
#451233 by Redhawk18 · opened 12mo ago · 5 comments