Tornado

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado

Tornado has incomplete validation of cookie attributes

Tornado vulnerable to excessive logging caused by malformed multipart form data

Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)

Tornado has an HTTP cookie parsing DoS vulnerability

Tornado CRLF injection vulnerability

Tornado has cookie attribute injection via .RequestHandler.set_cookie

Open redirect in Tornado

Tornado is vulnerable to DoS due to too many multipart parts

Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths