CVE-2026-49854 json
Tornado: Out-of-bounds memory access in C extension
published 2026-06-12 4 mo ago modified 2026-10-24 15 d ago also EUVD-2026-44504 , GHSA-cx3h-4qpv-8hc9 , PYSEC-2026-3388
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 36%
- public exploits
- 0
- none known
Summary
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.
Patch / fix
- pypi tornado 6.5.6
- tornadoweb tornado 6.5.6
- grafana Multi Linux Manager Tools SLE-15 12.4.10-150002.4.27.1
- mgr-push Multi Linux Manager Tools SLE-15 5.2.5-150002.3.12.1
- spacecmd Multi Linux Manager Tools SLE-15 5.2.10-150002.3.15.1
- uyuni-tools Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 5.2.17-150002.3.20.1
- venv-salt-minion Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 3006.0-150002.5.22.1
- spacewalk-client-tools Multi Linux Manager Tools SLE-15 5.2.7-150002.3.12.1
- golang-github-prometheus-prometheus Multi Linux Manager Tools SLE-15 3.13.2-150002.3.19.1
- mgr-push Multi Linux Manager Tools SLE-12 5.2.5-120002.3.12.1
suse advisories SUSE-SU-2026:4585-1SUSE-SU-2026:4584-1SUSE-SU-2026:4583-1SUSE-SU-2026:4582-1SUSE-SU-2026:4581-1SUSE-SU-2026:4580-1
- python-tornado6 openSUSE Leap 16.0 6.5-160000.5.1
- python-tornado6 openSUSE Tumbleweed 6.5.7-1.1
opensuse advisories openSUSE-SU-2026:21067-1openSUSE-SU-2026:11027-1
- github.com/tornadoweb/tornado@96dc88c commit
- github.com/tornadoweb/tornado#3626 pull request
- github.com/tornadoweb/tornado/releases/tag/v6.5.6 release
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-49854 updated cvss 5.3
tornado: Tornado: Information disclosure via out-of-bounds read in websocket_mask
-
Red Hat Exploit Intelligence exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat External Secrets Operator for Red Hat OpenShift external-secrets-operator/external-secrets-rhel9, external-secrets-operator/bitwarden-sdk-server-rhel9, external-secrets-operator/external-secrets-operator-rhel9, external-secrets-operator/external-secrets-operator-bundle Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9, lightspeed-core/lightspeed-stack-rhel9, lightspeed-core/rag-tool-cuda-12.9-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-solution-server-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-ocp-rag-rhel9 Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/lightspeed-chatbot-rhel9, ansible-automation-platform-27/lightspeed-chatbot-rhel9affected: no fix available “Fix deferred”
-
Red Hat Enterprise Linux 7 python-tornadoaffected: no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 8 pcs, pcs-snmp Red Hat Enterprise Linux 9 python-tornado, python3-tornado, rhel9/keylime-verifier, rhel9/keylime-registrar Red Hat Enterprise Linux 10 python-tornado, rhel10/keylime-verifier, rhel10/keylime-registrar Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-llama-stack-core-rhel9, rhoai/odh-th06-cpu-torch210-py312-rhel9, rhoai/odh-th06-cpu-torch291-py312-rhel9, rhoai/odh-th06-rocm64-torch291-py312-rhel9, rhoai/odh-th06-cuda130-torch210-py312-rhel9, rhoai/odh-th06-cuda130-torch291-py312-rhel9, +19 more Red Hat OpenShift Container Platform 4 python-flit, python-pep517, python-tornado, openshift/ose-rhel-coreos-9affected: no fix available “Fix deferred”
+1 more productsfewer
Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | tornado | <6.5.6 |
6.5.6 |
Affected products
- tornadoweb tornado
Classification
- Weakness
-
- CWE-126 Buffer Over-read
References
- github.com /tornadoweb/tornado/pull/3626
- github.com /tornadoweb/tornado/commit/96dc88c2a05705287856b2cd6b4b4034f9a6aaac
-
github.com
/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9
web
-
github.com
/tornadoweb/tornado/releases/tag/v6.5.6
web
-
github.com
/tornadoweb/tornado
package
-
pypi.org
/project/tornado
package
-
github.com
/advisories/GHSA-cx3h-4qpv-8hc9
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-49854
advisory
Sources
- CVE List CVE-2026-49854
- GitHub Advisory GHSA-cx3h-4qpv-8hc9
- NVD CVE-2026-49854
- OSV PYSEC-2026-3388
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.