Tornado vulnerabilities

A vulnerability in Tornado before version 6.5.6 allows unlimited decompression of gzip data, potentially leading to memory exhaustion by a malicious server or SimpleAsyncHTTPClient.

In Tornado before version 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes. This allows the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active.

In Tornado before version 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.