High RHSA-2026:24342 2 CVEs

Red Hat Security Advisory: python-tornado security update

Published Jun 8, 2026 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 3

Release	Package	Fixed in
Red Hat · RHEL 7 ELS rhel_els:7	python-tornado	0:4.2.1-5.el7_9.3
Red Hat · RHEL 7 ELS rhel_els:7	python-tornado-debuginfo	0:4.2.1-5.el7_9.3
Red Hat · RHEL 7 ELS rhel_els:7	python-tornado-doc	0:4.2.1-5.el7_9.3

Vulnerabilities 2

High 8.7

CVE-2026-31958

Tornado has a DoS due to too many multipart parts

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the max_body_size setting (default 100MB). Since parsing occurs synchronously on the …

tornadoweb tornado airflow-3 kubeflow-pipelines-visualization-server Debian Ubuntu Wolfi PyPI

Mar 11, 2026
High 7.2

CVE-2026-35536

Tornado has incomplete validation of cookie attributes

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

tornadoweb tornado mitmproxy python-tornado Debian Ubuntu Wolfi PyPI

Apr 3, 2026

References

article
https://access.redhat.com/security/updates/classification/#moderate
report
https://bugzilla.redhat.com/show_bug.cgi?id=2446765
report
https://bugzilla.redhat.com/show_bug.cgi?id=2454716
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24342.json
report
https://access.redhat.com/security/cve/CVE-2026-31958
advisory
https://www.cve.org/CVERecord?id=CVE-2026-31958
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-31958
article
https://github.com/tornadoweb/tornado/security/advisories/GHSA-qjxf-f2mg-c6mc
report
https://access.redhat.com/security/cve/CVE-2026-35536
advisory
https://www.cve.org/CVERecord?id=CVE-2026-35536
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-35536
article
https://github.com/tornadoweb/tornado/releases/tag/v6.5.5
article
https://github.com/tornadoweb/tornado/security/advisories/GHSA-78cv-mqj4-43f7