Security Update for python3-tornado: Mitigating Denial of Service and Cookie Injection Vulnerabilities
Summary
ALSA-2026:19189: Moderate: python-tornado security update. Affects python3-tornado versions < 6.5.5-1.el9_8. Fixed in 6.5.5-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3-tornado is a web framework and asynchronous networking library designed for building scalable web applications. It is known for its high performance and ability to handle thousands of simultaneous connections. However, it has recently been identified to have security vulnerabilities that could affect its integrity and the applications built upon it.
Vulnerability Detail
The vulnerabilities in python3-tornado stem from two main issues: a Denial of Service (DoS) vulnerability caused by the handling of large multipart bodies (CVE-2026-31958) and a cookie attribute injection vulnerability due to improper handling of cookie arguments (CVE-2026-35536). These vulnerabilities could allow an attacker to disrupt service availability or manipulate session cookies, potentially leading to unauthorized access or data leakage.
How To Fix
Minimum fixed version
6.5.5-1.el9_8
This is the first release that contains the fix.
sudo dnf update python3-tornadoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the size of multipart requests in your application to mitigate the risk of Denial of Service attacks. This can be done by configuring your server settings to reject requests that exceed a certain size limit.
Conclusion
The python3-tornado package has critical vulnerabilities that need to be addressed to maintain the security of applications built with it. By updating to the latest patched version, users can protect their systems from potential attacks. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for python3-tornado →
FAQ
CVE-2026-31958 is a vulnerability in python3-tornado that allows for Denial of Service attacks via large multipart bodies.
CVE-2026-35536 is a vulnerability that allows for cookie attribute injection due to improper handling of cookie arguments in python3-tornado.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application by uploading a manifest file like package-lock.json at Vulert Scanner.
The vulnerabilities could lead to service disruptions, unauthorized access, or data leakage, compromising the security and integrity of applications using python3-tornado.
Yes, a patch is available in the form of an updated package version 6.5.5-1.el9_8. It is recommended to update to this version to mitigate the vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for python3-tornado.
