Skip to content
OpenAdvisories
High ALSA-2026:67146 4 CVEs

Important: python-tornado security update

Published Sep 14, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects (CVE-2026-49853)
* tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption (CVE-2026-49855)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
AlmaLinux · 9 python3-tornado 6.5.8-0.el9_8.1

Vulnerabilities 4

  • High 7.7
    CVE-2026-49853

    Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when …

    tornadoweb tornado mitmproxy python-tornado Debian Ubuntu Azure Linux Wolfi PyPI
  • High 7.5
    CVE-2026-49855

    tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server acces…

    tornadoweb tornado mitmproxy python-tornado Debian Ubuntu Azure Linux Wolfi PyPI
  • High 7.5
    CVE-2026-82397

    Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in t…

    tornadoweb tornado kubeflow-pipelines-visualization-server dask-kubernetes Debian Ubuntu Azure Linux Wolfi PyPI
  • High 7.5
    CVE-2026-91990

    Tornado before 6.5.8 Memory Amplification DoS via multipart

    Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, ex…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux PyPI

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-49853
  • report
    https://access.redhat.com/security/cve/CVE-2026-49855
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-67146.html
  • report
    https://www.redhat.com/security/data/cve/CVE-2026-82397.html
  • report
    https://www.redhat.com/security/data/cve/CVE-2026-91990.html