Moderate Security Update for python-tornado: Denial of Service and Cookie Injection Vulnerabilities
Summary
RLSA-2026:13641: Moderate: python-tornado security update. Affects python-tornado versions < 0:6.5.5-1.el10_1.1. Fixed in 0:6.5.5-1.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-tornado is a scalable, non-blocking web server and web application framework designed for handling large volumes of simultaneous connections. It is widely used for building web applications that require long-lived network connections, such as WebSockets. The framework is known for its performance and flexibility, but it is also susceptible to security vulnerabilities that can compromise the integrity and availability of applications built on it.
Vulnerability Detail
The vulnerabilities in python-tornado include a Denial of Service (DoS) attack vector through large multipart bodies (CVE-2026-31958) and cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536). The DoS vulnerability allows an attacker to overwhelm the server by sending excessively large multipart requests, potentially leading to service outages. The cookie injection vulnerability can allow attackers to manipulate cookie attributes, which may lead to session hijacking or other malicious activities.
How To Fix
Minimum fixed version
0:6.5.5-1.el10_1.1
This is the first release that contains the fix.
sudo dnf update python-tornadoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the size of multipart requests handled by your application to mitigate the risk of DoS attacks. This can be done by configuring your Tornado application to reject requests that exceed a certain size limit.
Conclusion
The python-tornado framework has been identified with moderate security vulnerabilities that can lead to Denial of Service and cookie injection attacks. It is crucial for users to update to the latest patched version to safeguard their applications. Additionally, temporary workarounds can be implemented to mitigate risks until updates are applied.
See every vulnerability recorded for python-tornado →
FAQ
The CVSS score for the vulnerabilities is 5.4, indicating a moderate severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerabilities can lead to service outages due to Denial of Service attacks and potential session hijacking through cookie manipulation.
Yes, you can implement request size limits in your Tornado application to reduce the risk of DoS attacks as a temporary workaround.
The Rocky Enterprise Software Foundation and Red Hat are credited with addressing these vulnerabilities through security updates.
Related vulnerabilities
Recent vulnerabilities recorded for python-tornado.
