Critical Security Flaws in Python-Tornado: Information Disclosure and DoS Risks
Summary
RLSA-2026:67147: Important: python-tornado security update. Affects python-tornado versions < 0:6.5.8-0.el10_2.1. Fixed in 0:6.5.8-0.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Tornado is a scalable, non-blocking web server and web application framework designed for handling asynchronous networking. It is widely used for building web applications that require long-lived network connections, such as WebSockets. The framework is known for its high performance and ability to handle thousands of simultaneous connections. However, recent vulnerabilities have been identified that could compromise the security of applications built using this framework.
Vulnerability Detail
The vulnerabilities in Python-Tornado stem from improper handling of credentials during HTTP redirects, leading to potential information disclosure (CVE-2026-49853). Additionally, there is a risk of Denial of Service (DoS) due to uncontrolled memory consumption during gzip decompression (CVE-2026-49855). These vulnerabilities can allow attackers to exploit the application, potentially exposing sensitive information or causing service disruptions.
How To Fix
Minimum fixed version
0:6.5.8-0.el10_2.1
This is the first release that contains the fix.
sudo dnf update python-tornadoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can mitigate the risk of information disclosure by implementing strict validation of redirects in your application code. Additionally, consider limiting the size of incoming requests to prevent excessive memory consumption during gzip decompression.
Conclusion
In summary, the recent vulnerabilities in Python-Tornado pose significant risks, including information disclosure and Denial of Service. It is crucial to update to the latest patched version to safeguard your applications. Additionally, utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for python-tornado →
FAQ
The CVSS score for these vulnerabilities is 7.7, indicating a high level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerabilities could lead to unauthorized access to sensitive information and service disruptions, affecting the overall integrity and availability of your application.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If an immediate update is not possible, implement workarounds such as strict validation of redirects and limiting request sizes to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-tornado.
