Moderate Security Update for python3-tornado: Addressing Denial of Service and Cookie Injection Vulnerabilities
Summary
ALSA-2026:13670: Moderate: python-tornado security update. Affects python3-tornado versions < 6.5.5-1.el9_7.1. Fixed in 6.5.5-1.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3-tornado is a web framework and asynchronous networking library designed for building scalable web applications. It is known for its high performance and ability to handle thousands of simultaneous connections. However, it has recently been identified as vulnerable to security issues that could lead to Denial of Service (DoS) attacks and cookie attribute injection, compromising the integrity and availability of applications built using this framework.
Vulnerability Detail
The vulnerabilities stem from improper handling of multipart bodies and cookie arguments within the Tornado framework. Specifically, CVE-2026-31958 allows attackers to exploit large multipart bodies, potentially leading to service disruptions. Meanwhile, CVE-2026-35536 involves cookie attribute injection, which could allow unauthorized manipulation of cookie data, posing risks to user sessions and data integrity.
How To Fix
Minimum fixed version
6.5.5-1.el9_7.1
This is the first release that contains the fix.
sudo dnf update python3-tornadoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the size of multipart requests handled by your application to mitigate the risk of Denial of Service attacks. This can be done by implementing request size limits in your application logic or web server configuration.
Conclusion
In summary, the python3-tornado package has been identified with moderate severity vulnerabilities that require immediate attention. Updating to the latest patched version is crucial to ensure the security and stability of applications relying on this framework. Utilizing tools like Vulert can aid in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for python3-tornado →
FAQ
The vulnerabilities can lead to Denial of Service attacks and unauthorized manipulation of cookie data, affecting application availability and security.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json to Vulert's playground, you can check for vulnerabilities without needing to install any software.
If an immediate update is not possible, consider implementing request size limits and reviewing cookie handling in your application as a temporary workaround.
While specific exploits may not be publicly disclosed, the nature of the vulnerabilities suggests that they could be exploited by attackers to disrupt services or manipulate session data.
Detailed information about the vulnerabilities can be found on the CVE pages for CVE-2026-31958 and CVE-2026-35536, which provide insights into the technical aspects and potential impacts.
Related vulnerabilities
Recent vulnerabilities recorded for python3-tornado.
