Skip to content
OpenAdvisories
High RHSA-2026:98106 5 CVEs

Red Hat Security Advisory: python-tornado security update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream python-tornado 0:6.5.10-0.el9_2.1
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream python-tornado-debugsource 0:6.5.10-0.el9_2.1
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream python3-tornado 0:6.5.10-0.el9_2.1
Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream python3-tornado-debuginfo 0:6.5.10-0.el9_2.1

Vulnerabilities 5

  • High 7.7
    CVE-2026-49853

    Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when …

    tornadoweb tornado mitmproxy python-tornado Debian Ubuntu Azure Linux Wolfi PyPI
  • High 7.5
    CVE-2026-103262

    Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

    Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that acc…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux PyPI
  • High 7.5
    CVE-2026-49855

    tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server acces…

    tornadoweb tornado mitmproxy python-tornado Debian Ubuntu Azure Linux Wolfi PyPI
  • High 7.5
    CVE-2026-82397

    Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in t…

    tornadoweb tornado kubeflow-pipelines-visualization-server dask-kubernetes Debian Ubuntu Azure Linux Wolfi PyPI
  • High 7.5
    CVE-2026-91990

    Tornado before 6.5.8 Memory Amplification DoS via multipart

    Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, ex…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2500672
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2500686
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2526562
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2533953
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2544534
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98106.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-49853
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-49853
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-49853
  • article
    https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751
  • article
    https://github.com/tornadoweb/tornado/pull/3626
  • article
    https://github.com/tornadoweb/tornado/releases/tag/v6.5.6
  • article
    https://github.com/tornadoweb/tornado/security/advisories/GHSA-3x9g-8vmp-wqvf
  • report
    https://access.redhat.com/security/cve/CVE-2026-49855
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-49855
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-49855
  • article
    https://github.com/tornadoweb/tornado/commit/ff808b33adc52d89a549376a5e3628e92abbc8ff
  • article
    https://github.com/tornadoweb/tornado/security/advisories/GHSA-mgf9-4vpg-hj56
  • report
    https://access.redhat.com/security/cve/CVE-2026-82397
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-82397
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-82397
  • article
    https://github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191de
  • article
    https://github.com/tornadoweb/tornado/pull/3704
  • article
    https://github.com/tornadoweb/tornado/releases/tag/v6.5.8
  • article
    https://github.com/tornadoweb/tornado/security/advisories/GHSA-mpf4-983q-p7j4
  • report
    https://access.redhat.com/security/cve/CVE-2026-91990
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-91990
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-91990
  • article
    https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq
  • article
    https://www.vulncheck.com/advisories/tornado-before-6.5.8-memory-amplification-dos-via-multipart
  • report
    https://access.redhat.com/security/cve/CVE-2026-103262
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-103262
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-103262
  • article
    https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9
  • article
    https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp
  • article
    https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-curlasynchttpclient