Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
tornadoweb/tornado
master @ 3239945
22
Fixes
10
CVEs
HIGH
Peak severity
66.7%
Coverage
Highlights
Denial of Service: 6 prior fixes. Scrutinize any change in this area.
tornado/httputil.py: most-fixed (12 issues). Treat as high-risk during review.
8 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: Algorithmic complexity vulnerabilities (O(N^2) CPU exhaustion) regularly affect parsing routines for cookies, multi-value HTTP headers, and multipart form parameter structures. This blocks Tornado's single-threaded event loop, leading to rapid remote service deprivation.
HTTP Request Smuggling: Inconsistencies and permissive checks during HTTP request start-line validation, header name parsing, and Host header validation enable discrepancy-based proxy desynchronization and request smuggling.
HTTP Response Splitting: Failure to tightly validate HTTP header keys, values, and custom reason phrases has allowed control character injections (e.g., carriage returns, line feeds, and DEL bytes) to manipulate the raw HTTP stream structure, risking cache poisoning and arbitrary response injection.