Sep 15, 2026 Bug fixes `tornado.web` The allowed_symlink_directory argument of StaticFileHandler may now be a list of directories instead of just a single directory. This feature has been adjusted to improve compatibility with Jupyter, which would fail to load with Tornado 6.5.9.
Sep 14, 2026 Security fixes - `.StaticFileHandler` no longer follows symlinks outside of the static root directory. Applications that wish to continue the previous behavior may set the new argument ``allowed_symlink_directory`` to the directory (an ancestor of the static root) that should be used for symlink validation. Thanks to `afldl <https://github.com/afldl>`_ and `iaokhut-from-NightWolf-Team…
Aug 6, 2026 Security fixes - Form-encoded ``POST`` bodies are now subject to a limit of 1000 arguments by default. This prevents a CPU and memory denial of service attack. This limit can be overridden via the `.set_parse_body_config` function. Thanks to `Arpit Jain <https://github.com/arpitjain099>`_ for reporting this issue. - Multipart parsing now rejects requests with an excessive number of par…
Jun 8, 2026 Security fixes - ``CurlAsyncHTTPClient`` now fully resets the curl object before reusing it. This prevents incorrectly reusing options from a previous request, specifically including client SSL and credentials used for accessing proxies. Thanks to `Koh Jun Sheng <https://github.com/seankohjs>`_ for reporting this issue.
May 27, 2026 Security fixes - ``SimpleAsyncHTTPClient`` now strips the ``Authorization`` and ``Cookie`` headers from the request when following a redirect to a different origin. This matches the default behavior of ``CurlAsyncHTTPClient``. Applications that need different behavior here can set ``follow_redirects=False`` and handle redirects manually. Thanks to [Yannick Wang](https://github.com/noo…
Mar 10, 2026 Security fixes - ``multipart/form-data`` requests are now limited to 100 parts by default, to prevent a denial-of-service attack via very large requests with many parts. This limit is configurable via `tornado.httputil.ParseMultipartConfig`. Multipart parsing can also be disabled completely if not required for the application. Thanks to [0x-Apollyon](https://github.com/0x-Apollyon) an…
Dec 15, 2025 Bug fixes - The ``in`` operator for ``HTTPHeaders`` was incorrectly case-sensitive, causing lookups to fail for headers with different casing than the original header name. This was a regression in version 6.5.3 and has been fixed to restore the intended case-insensitive behavior from version 6.5.2 and earlier.
Dec 10, 2025 Security fixes - Fixed a denial-of-service vulnerability involving quadratic computation when parsing ``multipart/form-data`` request bodies. `CVE-2025-67726 <https://github.com/tornadoweb/tornado/security/advisories/GHSA-jhmp-mqwm-3gq8>`_ Thanks to `Finder16 <https://github.com/Finder16>`_ for reporting this issue. - Fixed a denial-of-service vulnerability involving quadratic computa…
Aug 8, 2025 Bug fixes - Fixed a bug that resulted in WebSocket pings not being sent at the configured interval. - Improved logging for invalid ``Host`` headers. This was previouisly logged as an uncaught exception with a stack trace, now it is simply a 400 response (logged as a warning in the access log) - Restored the ``host`` argument to ``.HTTPServerRequest``. This argument is deprecated and wi…
May 22, 2025 Bug fixes - Fixed a bug in ``multipart/form-data`` parsing that could incorrectly reject filenames containing characters above U+00FF (i.e. most characters outside the Latin alphabet).
May 15, 2025 Security Improvements - Previously, malformed ``multipart-form-data`` requests could log multiple warnings and constitute a denial-of-service attack. Now an exception is raised at the first error, so there is only one log message per request. This fixes `CVE-2025-47287 <https://github.com/tornadoweb/tornado/security/advisories/GHSA-7cx3-6m66-7c5m>`_. General Changes ~~~~~~~~~~~~~~~ -…
Prepare for release 6.5b1
Nov 21, 2024 Security Improvements - Parsing of the cookie header is now much more efficient. The older algorithm sometimes had quadratic performance which allowed for a denial-of-service attack in which the server would spend excessive CPU time parsing cookies and block the event loop. This change fixes CVE-2024-7592.