pypi:tornadoThis dossier links the stable identity pypi:tornado to 6 exact observed versions across 8 public repositories.
A package identity or provider interface in published code does not prove configuration, an account, procurement, data transfer or an API call.
ecosystem:name + exact version + evidence pathPublication age and licenses come from deps.dev metadata. They are context—not a maintenance, legal or portability verdict.
22 Nov 202422 May 202508 Aug 202515 Dec 202510 Mar 202608 Jun 2026landeshauptstadt-muenchen/mucgpt3 Occurrencessh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendung2 Occurrencessh/diwish/splitbot/kosmo/llm-service1 Occurrenceuba-ki-lab/gsa-extraction1 Occurrenceuba-ki-lab/objection-management1 Occurrenceuba-ki-lab/ressource-efficient-computer-vision1 Occurrenceuba-ki-lab/strahlenexposition1 Occurrenceuba-ki-lab/workshop-green-llm-usage1 Occurrenceuba-ki-lab/gsa-extractionuv.locksh/diwish/splitbot/kosmo/llm-serviceuv.locklandeshauptstadt-muenchen/mucgptmucgpt-assistant-service/uv.locklandeshauptstadt-muenchen/mucgptmucgpt-core-service/uv.locklandeshauptstadt-muenchen/mucgptuv.lockuba-ki-lab/objection-managementuv.lockuba-ki-lab/ressource-efficient-computer-visionuv.locksh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendungblp_streamlit_pipeline/src/ext/streamlit-draw-image-mask/poetry.locksh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendungpoetry.lockuba-ki-lab/strahlenexpositionsbom.jsonuba-ki-lab/workshop-green-llm-usageuv.lockTornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
13 Jul 2026Tornado has incomplete validation of cookie attributes
13 Jul 2026Tornado vulnerable to excessive logging caused by malformed multipart form data
07 Jul 2026tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
01 Sept 2026Tornado: Quadratic DoS via Repeated Header Coalescing
20 Jul 2026Tornado has out-of-bounds memory access via C extension
13 Jul 2026Tornado: Quadratic DoS via Crafted Multipart Parameters
20 Jul 2026tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)
13 Jul 2026Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
02 Sept 2026Tornado vulnerable to Header Injection and XSS via reason argument
20 Jul 2026Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse
17 Jun 2026Tornado is vulnerable to DoS due to too many multipart parts
08 Jun 2026Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`
01 Sept 2026Only exact npm and PyPI tuples are enriched. Reported SPDX expressions are metadata; no compatibility, obligation or legal conclusion is inferred.
Retrieval, parsing, matching and publishing use no generative AI model.i6eal (2026): tornado — exact AI dependency evidence dossier, data state 02 Sept 2026. https://i6eal.de/en/tools/ki-abhaengigkeitsatlas/paket/tornado-ab0f364e/
We build source-backed data products with stable identities, reproducible joins and boundaries that remain visible.
These tools complement the current result.