StackPrism

PyPI package

tornado vulnerabilities by version

The latest release, 6.5.10 (Sep 15, 2026), has no known vulnerabilities. 8 of the 10 most recent releases have known vulnerabilities. OSV.dev lists 23 advisories for tornado; the newest was published on Sep 30, 2026.

PyPI (opens in a new tab) describes it as “Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.”

Latest release
6.5.10
Sep 15, 2026, no known vulnerabilities
Downloads last week
25.3M
All versions, from pypistats.org
Advisories on OSV.dev
23
Newest Sep 30, 2026
Licence
Apache-2.0
OpenSSF Scorecard
6.6/10
tornadoweb/tornado (opens in a new tab)

Recent releases

PyPI doesn’t publish downloads per version, so these are the newest releases, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilities
6.5.10latestSep 15, 2026No known vulnerabilities
6.5.9Sep 14, 2026No known vulnerabilities
6.5.8Aug 7, 20263 known vulnerabilities, worst rated critical
6.5.7Jun 8, 20266 known vulnerabilities, worst rated critical
6.5.6May 27, 20267 known vulnerabilities, worst rated critical
6.5.5Mar 10, 202610 known vulnerabilities, worst rated critical
6.5.4Dec 15, 202511 known vulnerabilities, worst rated critical
6.5.3Dec 11, 202511 known vulnerabilities, worst rated critical
6.5.2Aug 8, 202514 known vulnerabilities, worst rated critical
6.5.1May 22, 202514 known vulnerabilities, worst rated critical

Release lines

The newest release of each minor line, from the registry. tornado doesn’t publish support dates we can check.

LineNewest releaseReleased
6.56.5.10Sep 15, 2026
6.46.4.2Nov 22, 2024
6.36.3.3Aug 11, 2023
6.26.2.0Jul 3, 2022
6.16.1.0Oct 30, 2020
6.06.0.4Mar 4, 2020

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. WarningCVE-2026-103261 on OSV.dev (opens in a new tab)GHSA-3hv7-mjh2-fv65

    Tornado: Unbounded query-string argument count allows event-loop-stalling DoS

    Affects < 6.5.9. Published Sep 30, 2026.

  2. CriticalCVE-2026-103262 on OSV.dev (opens in a new tab)GHSA-chx6-46f5-w4vp

    tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM

    Affects < 6.5.9. Published Sep 30, 2026.

  3. CriticalCVE-2026-103263 on OSV.dev (opens in a new tab)GHSA-c2m8-h5v5-343r

    Tornado: StaticFileHandler follows symlinks outside static root (path traversal)

    Affects < 6.5.9. Published Sep 30, 2026.

  4. CriticalCVE-2026-82397 on OSV.dev (opens in a new tab)GHSA-mpf4-983q-p7j4

    Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

    Affects < 6.5.8. Published Sep 2, 2026.

  5. WarningCVE-2026-91990 on OSV.dev (opens in a new tab)GHSA-8423-8fgw-73vq

    tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

    Affects < 6.5.8. Published Sep 1, 2026.

All 23 advisories are on OSV.dev (opens in a new tab).

Which tornado do you have?

Paste a public GitHub repo or drop your requirements.txt or pyproject.toml and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for tornado, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from pypistats.org. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, PyPI, pypistats.org and deps.dev.