CVE-2014-9720: Tornado CSRF Token Disclosure
Summary
CVE-2014-9720: Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a s... Affects tornado across 2 version ranges.
< 1c36307463b1e8affae100bf9386948e6c1b2308
< 3.2.2
Fixed in 1c36307463b1e8affae100bf9386948e6c1b2308. How to fix ↓
Also tracked for
- python-tornado · Debian:11
The same CVE-2014-9720 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tornado is a Python web framework and asynchronous networking library. It is widely used for building scalable and high-performance web applications. Tornado versions before 3.2.2 are affected by a vulnerability that allows remote attackers to conduct a BREACH attack and determine the CSRF token. This vulnerability arises from Tornado sending arbitrary responses containing a fixed CSRF token, which may be sent with HTTP compression.
Vulnerability Detail
The vulnerability in Tornado allows remote attackers to exploit the BREACH attack technique to determine the fixed CSRF token. By sending a series of crafted requests, an attacker can analyze the compressed responses and extract the CSRF token. This token can then be used to bypass CSRF protection mechanisms and perform unauthorized actions on behalf of the victim. The vulnerability was introduced in Tornado version 0 and was fixed in version 3.2.2.
How To Fix
Latest published version: 6.6.0 as of 23 Oct 2026
pip install --upgrade "tornado==6.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1c36307463b1e8affae100bf9386948e6c1b2308
This is the first release that contains the fix.
pip install --upgrade "tornado==1c36307463b1e8affae100bf9386948e6c1b2308"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a workaround to mitigate the vulnerability is to disable HTTP compression in Tornado. This can be achieved by modifying the server configuration to exclude compression or by using a reverse proxy that handles compression before reaching the Tornado server.
Conclusion
The vulnerability in Tornado versions before 3.2.2 allows remote attackers to exploit the BREACH attack technique and determine the CSRF token. To mitigate this vulnerability, it is recommended to upgrade Tornado to version 3.2.2 or later. If upgrading is not feasible immediately, disabling HTTP compression can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tornado →
FAQ
Tornado is a Python web framework and asynchronous networking library known for its high performance and scalability.
A CSRF token is a security measure used to protect against Cross-Site Request Forgery (CSRF) attacks. It is a unique token generated for each user session and included in requests to verify the authenticity of the request.
A BREACH attack is a compression-based attack that allows an attacker to extract sensitive information, such as CSRF tokens, by analyzing the compressed responses from a web server.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Tornado application is affected by this vulnerability. Simply provide the Pipfile.lock of your application, and Vulert will analyze it for vulnerabilities in real-time.
Yes, if upgrading to the latest version is not immediately possible, you can disable HTTP compression in Tornado as a temporary workaround. This can help mitigate the vulnerability until a proper upgrade can be performed.
Related vulnerabilities
Recent vulnerabilities recorded for tornado.
