diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4a18074f..b2ca4f8c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@ TBD
 ### Bug fixes
 - Fix upload root files being hidden ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/590))
 - Send empty json for no banned/cached players ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/589))
+- Bump Tornado from 6.0 to 6.3.2 in response to CVE-2023-28370 ([Merge Request](https://gitlab.com/crafty-controller/crafty-4/-/merge_requests/591))
 ### Tweaks
 TBD
 ### Lang
diff --git a/requirements.txt b/requirements.txt
index 3a1bd5e5..4c36b691 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -15,7 +15,7 @@ pyjwt==2.4.0
 PyYAML==5.4
 requests==2.26
 termcolor==1.1
-tornado==6.0
+tornado==6.3.2
 tzlocal==4.0
 jsonschema==4.5.1
 orjson==3.8.12