Critical Security Update for python3-tornado: Addressing Information Disclosure and Denial of Service Vulnerabilities
Summary
ALSA-2026:67146: Important: python-tornado security update. Affects python3-tornado versions < 6.5.8-0.el9_8.1. Fixed in 6.5.8-0.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3-tornado is a web framework and asynchronous networking library designed for building scalable web applications. It supports long-lived network connections and is widely used for handling real-time web services. However, it has been found vulnerable to specific security issues that can lead to information disclosure and denial of service attacks.
Vulnerability Detail
The vulnerabilities in python3-tornado stem from improper handling of credentials during HTTP redirects, which can lead to information disclosure (CVE-2026-49853). Additionally, an uncontrolled gzip decompression memory consumption can result in a denial of service (CVE-2026-49855). These vulnerabilities can be exploited by attackers to gain unauthorized access to sensitive information or to crash the application by exhausting memory resources.
How To Fix
Minimum fixed version
6.5.8-0.el9_8.1
This is the first release that contains the fix.
sudo dnf update python3-tornadoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling gzip compression in your application until the package can be updated. This can be done by modifying the server configuration to not use gzip for responses.
Conclusion
The python3-tornado package has critical vulnerabilities that require immediate attention. By updating to the latest patched version, users can protect their applications from potential exploits. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for open-source vulnerabilities.
See every vulnerability recorded for python3-tornado →
FAQ
The vulnerabilities can lead to unauthorized information disclosure and denial of service, potentially compromising application security and availability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, disabling gzip compression temporarily can help mitigate the denial of service risk until the patch is applied.
If immediate updates are not possible, ensure that your application is monitored for suspicious activity and consider implementing additional security measures.
Detailed information can be found on the CVE pages for CVE-2026-49853 and CVE-2026-49855, which provide insights into the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for python3-tornado.
