Skip to content
OpenAdvisories
High RHSA-2026:67147 4 CVEs

Red Hat Security Advisory: python-tornado security update

Published Sep 14, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 python-tornado 0:6.5.8-0.el10_2.1
Red Hat · RHEL 10 enterprise_linux:10.2 python-tornado-debugsource 0:6.5.8-0.el10_2.1
Red Hat · RHEL 10 enterprise_linux:10.2 python3-tornado 0:6.5.8-0.el10_2.1
Red Hat · RHEL 10 enterprise_linux:10.2 python3-tornado-debuginfo 0:6.5.8-0.el10_2.1

Vulnerabilities 4

  • High 7.7
    CVE-2026-49853

    Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when …

    tornadoweb tornado mitmproxy python-tornado Debian Ubuntu Azure Linux Wolfi PyPI
  • High 7.5
    CVE-2026-49855

    tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server acces…

    tornadoweb tornado mitmproxy python-tornado Debian Ubuntu Azure Linux Wolfi PyPI
  • High 7.5
    CVE-2026-82397

    Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in t…

    tornadoweb tornado kubeflow-pipelines-visualization-server dask-kubernetes Debian Ubuntu Azure Linux Wolfi PyPI
  • High 7.5
    CVE-2026-91990

    Tornado before 6.5.8 Memory Amplification DoS via multipart

    Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, ex…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2500672
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2500686
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67147.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-49853
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-49853
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-49853
  • article
    https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751
  • article
    https://github.com/tornadoweb/tornado/pull/3626
  • article
    https://github.com/tornadoweb/tornado/releases/tag/v6.5.6
  • article
    https://github.com/tornadoweb/tornado/security/advisories/GHSA-3x9g-8vmp-wqvf
  • report
    https://access.redhat.com/security/cve/CVE-2026-49855
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-49855
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-49855
  • article
    https://github.com/tornadoweb/tornado/commit/ff808b33adc52d89a549376a5e3628e92abbc8ff
  • article
    https://github.com/tornadoweb/tornado/security/advisories/GHSA-mgf9-4vpg-hj56
  • report
    https://access.redhat.com/security/cve/CVE-2026-82397
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2526562
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-82397
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-82397
  • article
    https://github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191de
  • article
    https://github.com/tornadoweb/tornado/pull/3704
  • article
    https://github.com/tornadoweb/tornado/releases/tag/v6.5.8
  • article
    https://github.com/tornadoweb/tornado/security/advisories/GHSA-mpf4-983q-p7j4
  • report
    https://access.redhat.com/security/cve/CVE-2026-91990
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533953
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-91990
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-91990
  • article
    https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq
  • article
    https://www.vulncheck.com/advisories/tornado-before-6.5.8-memory-amplification-dos-via-multipart