Skip to content
OpenAdvisories
High USN-8952-1 6 CVEs

python-tornado vulnerabilities

Published Oct 22, 2026 · Updated Nov 6, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Tornado did not properly handle certain HTTP requests
and network inputs. An attacker could possibly use these issues to cause a
denial of service, expose sensitive information, or bypass access controls.

(CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992,
CVE-2026-103262, CVE-2026-103263)

Fixed packages 7

ReleasePackageFixed in
Ubuntu · 24.04 LTS 24.04:LTS python-tornado 6.4.0-1ubuntu0.6
Ubuntu · 26.04 LTS 26.04:LTS python-tornado 6.5.4-0.1ubuntu0.2
Ubuntu · 26.10 python-tornado 6.5.5-5ubuntu1.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS python-tornado 4.2.1-1ubuntu3.1+esm4
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS python-tornado 4.5.3-1ubuntu0.2+esm4
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS python-tornado 6.0.3+really5.1.1-3ubuntu0.1~esm7
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS python-tornado 6.1.0-3ubuntu0.1~esm6

Vulnerabilities 6

  • High 7.5
    CVE-2023-54397

    Tornado before 6.3.3 HTTP Request Smuggling via Content-Length

    Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle re…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu PyPI
  • High 7.5
    CVE-2024-14029

    Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

    Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to pe…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux PyPI
  • High 7.5
    CVE-2026-103262

    Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

    Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that acc…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux PyPI
  • High 7.5
    CVE-2026-91990

    Tornado before 6.5.8 Memory Amplification DoS via multipart

    Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, ex…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux PyPI
  • Medium 5.9
    CVE-2026-103263

    Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink

    Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it,…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux PyPI
  • Medium 5.9
    CVE-2026-91992

    Tornado before 6.5.7 Credential Leak via Handle Reuse

    Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux PyPI

References

  • report
    https://ubuntu.com/security/CVE-2023-54397
  • report
    https://ubuntu.com/security/CVE-2024-14029
  • report
    https://ubuntu.com/security/CVE-2026-91990
  • report
    https://ubuntu.com/security/CVE-2026-91992
  • report
    https://ubuntu.com/security/CVE-2026-103262
  • report
    https://ubuntu.com/security/CVE-2026-103263