CVE-2026-49853
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
In Tornado before version 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.
Risk Assessment
The organization is at risk of leaking authentication credentials to unauthorized servers during redirects, potentially leading to account takeover or access to protected resources.
Recommendation
Immediately upgrade Tornado to version 6.5.6 or later, which fixes the vulnerability.
Other vulnerabilities in Tornado
See all- CVE-2026-49855High
A vulnerability in Tornado before version 6.5.6 allows unlimited decompression of gzip data, potentially leading to memory exhaustion by a malicious server or SimpleAsyncHTTPClient.
- CVE-2026-49854Medium
In Tornado before version 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes. This allows the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active.
- CVE-2026-35536High
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
Original NVD description (English source)
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.