Skip to content
OpenAdvisories

Package · Alpine

py3-tornado

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.4
    CVE-2025-67724

    Tornado vulnerable to Header Injection and XSS via reason argument

    Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Alpine PyPI