CVE-2026-49854
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
In Tornado before version 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes. This allows the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active.
Risk Assessment
The risk involves potential memory data leakage or unexpected application behavior, which could lead to disclosure of sensitive information or system integrity compromise.
Recommendation
It is recommended to immediately upgrade Tornado to version 6.5.6 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Tornado
See all- CVE-2026-49855High
A vulnerability in Tornado before version 6.5.6 allows unlimited decompression of gzip data, potentially leading to memory exhaustion by a malicious server or SimpleAsyncHTTPClient.
- CVE-2026-49853High
In Tornado before version 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.
- CVE-2026-35536High
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.
Original NVD description (English source)
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.