Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::highavailability | pcs | 0:0.10.12-6.el8_6.14 |
| Red Hat · RHEL 8.6 EUS Long Life rhel_eus_long_life:8.6::highavailability | pcs-snmp | 0:0.10.12-6.el8_6.14 |
Vulnerabilities 2
-
High 7.5
Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to pe…
-
High 7.5
Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in t…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2526562
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2533918
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85135.json
-
report
https://access.redhat.com/security/cve/CVE-2024-14029
-
advisory
https://www.cve.org/CVERecord?id=CVE-2024-14029
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-14029
-
article
https://github.com/tornadoweb/tornado/security/advisories/GHSA-753j-mpmx-qq6g
-
article
https://www.vulncheck.com/advisories/tornado-before-6.4.1-http-request-smuggling-via-transfer-encoding
-
report
https://access.redhat.com/security/cve/CVE-2026-82397
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-82397
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-82397
-
article
https://github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191de
-
article
https://github.com/tornadoweb/tornado/pull/3704
-
article
https://github.com/tornadoweb/tornado/releases/tag/v6.5.8
-
article
https://github.com/tornadoweb/tornado/security/advisories/GHSA-mpf4-983q-p7j4