These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2024-58384 is a medium-severity vulnerability in Tornado before 6.4.1, allowing CRLF injection via CurlAsyncHTTPClient. This vulnerability could enable attackers to inject arbitrary headers or construct new HTTP requests. Defenders should assess exposure, particularly in systems using Tornado for web services. Verification of affected versions, exploitation, and remediation details is necessary.
CVE-2024-14029 is a critical vulnerability in Tornado versions before 6.4.1, allowing for HTTP request smuggling when deployed behind proxies. This inconsistency arises from Tornado's handling of duplicate Transfer-Encoding: chunked headers, which can be exploited to bypass access control, poison caches, or desynchronize connections. The vulnerability has a critical CVSS score of 9 and can be exploited to [truncated]
CVE-2026-91991 is a vulnerability in Tornado before version 6.5.8 that allows attackers to inject arbitrary cookie attributes. This is due to an incomplete fix for cookie attribute injection, which permits attackers to bypass validation and modify cookie security attributes by passing capitalized or legacy keyword arguments to set_cookie. The vulnerability can be used to embed semicolon-delimited data in [truncated]
CVE-2026-49855 is a HIGH severity vulnerability in Tornado's gzip decompression routines. The issue allows a malicious server to consume effectively unlimited memory by processing limited-size chunks without enforcing an overall limit on accumulated decompressed chunks. This vulnerability is fixed in version 6.5.6. Users should review server configurations for SimpleAsyncHTTPClient or HTTPServer with deco [truncated]
CVE-2026-49853 is a HIGH severity vulnerability in Tornado's SimpleAsyncHTTPClient. Prior to version 6.5.6, the client shallow-copied redirected requests and removed only the Host header, leaving sensitive headers in place when a redirect changed scheme, host, or port. This issue allows potential exposure of sensitive information. Users should review their applications using SimpleAsyncHTTPClient and take [truncated]