Security Update for python3-tornado: Mitigating Denial of Service and Cookie Injection Vulnerabilities
Summary
ALSA-2026:13641: Moderate: python-tornado security update. Affects python3-tornado versions < 6.5.5-1.el10_1.1. Fixed in 6.5.5-1.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3-tornado is a web framework and asynchronous networking library designed for building web applications. It is known for its high performance and ability to handle thousands of simultaneous connections. However, it is susceptible to security vulnerabilities that can compromise the integrity and availability of applications built using this framework.
Vulnerability Detail
The vulnerabilities in python3-tornado arise from improper handling of multipart bodies and cookie arguments. Specifically, CVE-2026-31958 allows for Denial of Service attacks through large multipart bodies, potentially overwhelming the server. Meanwhile, CVE-2026-35536 involves cookie attribute injection, which can lead to unauthorized access or data manipulation. These vulnerabilities can severely impact application performance and security.
How To Fix
Minimum fixed version
6.5.5-1.el10_1.1
This is the first release that contains the fix.
sudo dnf update python3-tornadoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the size of multipart requests in your application to mitigate the risk of Denial of Service attacks. Additionally, ensure that cookie attributes are properly validated and sanitized before processing.
Conclusion
The python3-tornado package has critical vulnerabilities that require immediate attention. By updating to the latest patched version, you can protect your applications from potential attacks. Utilize tools like Vulert to monitor your software for vulnerabilities and ensure ongoing security.
See every vulnerability recorded for python3-tornado →
FAQ
The vulnerabilities include a Denial of Service risk due to large multipart bodies and cookie attribute injection that can lead to unauthorized access.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Check your application at Vulert Scanner.
Failure to address these vulnerabilities can lead to service outages, unauthorized access to sensitive data, and potential exploitation by malicious actors.
While updating is the best solution, you can implement request size limits and validate cookie attributes as temporary workarounds.
For more details, refer to the CVE pages for CVE-2026-31958 and CVE-2026-35536, which provide in-depth information about the vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for python3-tornado.
