Summary
[4.2.1-5.0.3]
- Backport fix for CVE-2026-31958 [Orabug: 39521310]
- Backport fix for CVE-2026-35536 [Orabug: 39521310]
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | python-tornado | 0:4.2.1-5.0.3.el7 |
| Oracle Linux · 7 | python-tornado-doc | 0:4.2.1-5.0.3.el7 |
Vulnerabilities 2
-
High 8.7
Tornado has a DoS due to too many multipart parts
Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the …
-
High 7.2
Tornado has incomplete validation of cookie attributes
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.