CVE-2026-49854
published 2026-07-14CVE-2026-49854: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.42%
35.1th percentile
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.
Affected
49 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| clusterlabs | pcs | — | — |
| debian | python-tornado | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| external-secrets-operator | bitwarden-sdk-server-rhel9 | — | — |
| external-secrets-operator | external-secrets-operator-bundle | — | — |
| external-secrets-operator | external-secrets-operator-rhel9 | — | — |
| external-secrets-operator | external-secrets-rhel9 | — | — |
| lightspeed-core | lightspeed-stack-rhel9 | — | — |
| lightspeed-core | rag-tool-cpu-rhel9 | — | — |
| lightspeed-core | rag-tool-cuda-12.9-rhel9 | — | — |
| mta | mta-solution-server-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| rhel10 | keylime-registrar | — | — |
| rhel10 | keylime-verifier | — | — |
| rhel9 | keylime-registrar | — | — |
| rhel9 | keylime-verifier | — | — |
| rhelai3 | bootc-cuda-rhel9 | — | — |
| rhelai3 | bootc-gaudi-rhel9 | — | — |
| rhelai3 | bootc-rocm-rhel9 | — | — |
| rhelai3 | disk-image-cuda-rhel9 | — | — |
| rhoai | odh-llama-stack-core-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-minimal-cpu-py312-rhel9 | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
tornado: Tornado: Information disclosure via out-of-bounds read in websocket_mask
vendor_redhat·2026-07-14·CVSS 5.3
CVE-2026-49854 [MEDIUM] CWE-125 tornado: Tornado: Information disclosure via out-of-bounds read in websocket_mask
tornado: Tornado: Information disclosure via out-of-bounds read in websocket_mask
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.
A flaw was found in Tornado, a Python web framework. The optional native extension `tornado.speedups` did not properly validate the `mask` argument in its `websocket_mask` function. This allowed the C function to read beyond the intended buffer, potentially exposing up to three bytes of unin
GHSA
Tornado has out-of-bounds memory access via C extension
ghsa·2026-06-12
CVE-2026-49854 [LOW] CWE-126 Tornado has out-of-bounds memory access via C extension
Tornado has out-of-bounds memory access via C extension
### Summary
Tornado's optional native extension `tornado.speedups` implements `websocket_mask` without validating that the `mask` argument is exactly four bytes long. The C function reads four bytes from `mask` unconditionally, even when Python passes a shorter byte string. This can read beyond the provided buffer, exposing up to 3 bytes of uninitialized memory.
The behavior is reachable from Tornado's XSRF token decoder when `xsrf_cookies=True` and the native extension is active.
### Mitigations
This bug is fixed in Tornado 6.5.6. Prior to upgrading to this version, setting the environment variable TORNADO_EXTENSION=0 will disable the vulnerable code (at the expense of reducing websocket performance).
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-49854 python-pep517: Tornado: Information disclosure via out-of-bounds read in websocket_mask [epel-all]
bugzilla·2026-07-15·CVSS 5.3
CVE-2026-49854 [MEDIUM] CVE-2026-49854 python-pep517: Tornado: Information disclosure via out-of-bounds read in websocket_mask [epel-all]
CVE-2026-49854 python-pep517: Tornado: Information disclosure via out-of-bounds read in websocket_mask [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.
Bugzilla
CVE-2026-49854 python-flit: Tornado: Information disclosure via out-of-bounds read in websocket_mask [epel-all]
bugzilla·2026-07-15·CVSS 5.3
CVE-2026-49854 [MEDIUM] CVE-2026-49854 python-flit: Tornado: Information disclosure via out-of-bounds read in websocket_mask [epel-all]
CVE-2026-49854 python-flit: Tornado: Information disclosure via out-of-bounds read in websocket_mask [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.
Bugzilla
CVE-2026-49854 python-tornado: Tornado: Information disclosure via out-of-bounds read in websocket_mask [fedora-all]
bugzilla·2026-07-15·CVSS 5.3
CVE-2026-49854 [MEDIUM] CVE-2026-49854 python-tornado: Tornado: Information disclosure via out-of-bounds read in websocket_mask [fedora-all]
CVE-2026-49854 python-tornado: Tornado: Information disclosure via out-of-bounds read in websocket_mask [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.
Bugzilla
CVE-2026-49854 python-flit: Tornado: Information disclosure via out-of-bounds read in websocket_mask [fedora-all]
bugzilla·2026-07-15·CVSS 5.3
CVE-2026-49854 [MEDIUM] CVE-2026-49854 python-flit: Tornado: Information disclosure via out-of-bounds read in websocket_mask [fedora-all]
CVE-2026-49854 python-flit: Tornado: Information disclosure via out-of-bounds read in websocket_mask [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.
Bugzilla
CVE-2026-49854 python-tornado: Tornado: Information disclosure via out-of-bounds read in websocket_mask [epel-all]
bugzilla·2026-07-15·CVSS 5.3
CVE-2026-49854 [MEDIUM] CVE-2026-49854 python-tornado: Tornado: Information disclosure via out-of-bounds read in websocket_mask [epel-all]
CVE-2026-49854 python-tornado: Tornado: Information disclosure via out-of-bounds read in websocket_mask [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.
Bugzilla
CVE-2026-49854 tornado: Tornado: Information disclosure via out-of-bounds read in websocket_mask
bugzilla·2026-07-14·CVSS 5.3
CVE-2026-49854 [MEDIUM] CVE-2026-49854 tornado: Tornado: Information disclosure via out-of-bounds read in websocket_mask
CVE-2026-49854 tornado: Tornado: Information disclosure via out-of-bounds read in websocket_mask
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.
2026-07-14
Published