Tornado

Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado

Tornado has incomplete validation of cookie attributes

Tornado vulnerable to excessive logging caused by malformed multipart form data

Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)

Tornado has an HTTP cookie parsing DoS vulnerability

Tornado has out-of-bounds memory access via C extension

Tornado CRLF injection vulnerability

Tornado has cookie attribute injection via .RequestHandler.set_cookie

Open redirect in Tornado