Critical Security Update for python3-tornado: Addressing Information Disclosure and Denial of Service Vulnerabilities
Summary
ALSA-2026:67147: Important: python-tornado security update. Affects python3-tornado versions < 6.5.8-0.el10_2.1. Fixed in 6.5.8-0.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3-tornado is a scalable, non-blocking web server and web application framework designed for building web applications in Python. It is particularly known for its ability to handle long-lived network connections, making it suitable for real-time web services. However, recent vulnerabilities have been identified that could compromise the security of applications using this framework.
Vulnerability Detail
The vulnerabilities in python3-tornado stem from improper handling of credentials during HTTP redirects, leading to potential information disclosure (CVE-2026-49853). Additionally, there is a Denial of Service (DoS) risk due to uncontrolled memory consumption during gzip decompression (CVE-2026-49855). These vulnerabilities could allow attackers to exploit the application, leading to unauthorized access to sensitive information or service disruptions.
How To Fix
Minimum fixed version
6.5.8-0.el10_2.1
This is the first release that contains the fix.
sudo dnf update python3-tornadoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the exposure of your application by implementing strict validation of HTTP redirects and monitoring memory usage during gzip decompression. However, the best course of action is to apply the update as soon as possible.
Conclusion
The vulnerabilities identified in python3-tornado pose significant risks to applications utilizing this framework. It is crucial to apply the recommended updates promptly to mitigate these risks and ensure the security of your applications.
See every vulnerability recorded for python3-tornado →
FAQ
python3-tornado is a web framework and asynchronous networking library for Python, designed to handle thousands of simultaneous connections efficiently.
The vulnerabilities include information disclosure through improper handling of credentials and a Denial of Service due to uncontrolled memory consumption during gzip decompression.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, implement strict validation of HTTP redirects and monitor memory usage as a temporary workaround.
For more details, refer to the CVE pages listed in the references section of the security advisory.
Related vulnerabilities
Recent vulnerabilities recorded for python3-tornado.
