diff --git a/requirements.txt b/requirements.txt
index 0ba969f0..7b8a21bd 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -24,3 +24,4 @@ threddsclient==0.4.4
 typing_extensions
 watchdog
 webob
+tornado>=6.3.3 # not directly required, pinned by Snyk to avoid a vulnerability