Moderate Security Update for python3-tornado: Addressing Denial of Service and Cookie Injection Vulnerabilities
Summary
ALSA-2026:19034: Moderate: python-tornado security update. Affects python3-tornado versions < 6.5.5-1.el10_2. Fixed in 6.5.5-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3-tornado is a web framework and asynchronous networking library designed for building web applications in Python. It is known for its high performance and ability to handle thousands of simultaneous connections, making it ideal for real-time web services. However, it has recently been identified to have vulnerabilities that could lead to denial of service attacks and cookie attribute injection, which could compromise the security of applications built using this framework.
Vulnerability Detail
The vulnerabilities identified in python3-tornado include a Denial of Service (DoS) attack vector through large multipart bodies (CVE-2026-31958) and cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536). The DoS vulnerability allows attackers to exploit the server by sending excessively large multipart requests, potentially overwhelming the server's resources. The cookie injection vulnerability can lead to unauthorized access or manipulation of session data, posing a significant risk to user security.
How To Fix
Minimum fixed version
6.5.5-1.el10_2
This is the first release that contains the fix.
sudo dnf update python3-tornadoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the size of multipart requests in your application to mitigate the risk of DoS attacks. This can be done by implementing request size checks in your application logic before processing incoming requests.
Conclusion
In summary, the python3-tornado package has been identified with moderate vulnerabilities that could lead to serious security issues if not addressed. It is crucial to update to the latest patched version to ensure the security of your applications. Implementing temporary workarounds can help mitigate risks until an update can be applied.
See every vulnerability recorded for python3-tornado →
FAQ
The vulnerabilities can lead to Denial of Service attacks and cookie attribute injection, which can compromise the security and availability of applications using the framework.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement request size checks and limit multipart request sizes as a temporary workaround.
Detailed information about the vulnerabilities can be found on the CVE pages: CVE-2026-31958 and CVE-2026-35536.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for python3-tornado.
