Source: python-tornado Version: 6.5.5-4 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for python-tornado. CVE-2026-49853[0]: | Tornado is a Python web framework and asynchronous networking | library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied | redirected requests and removed only the Host header, leaving | Authorization, auth_username, auth_password, and auth_mode in place | when a redirect changed scheme, host, or port. This issue is fixed | in version 6.5.6. CVE-2026-49854[1]: | Tornado is a Python web framework and asynchronous networking | library. Prior to 6.5.6, the optional native extension | tornado.speedups implemented websocket_mask without validating that | the mask argument is exactly four bytes, allowing the C function to | read up to three bytes beyond the provided buffer when reached | through Tornado XSRF token decoding with the native extension | active. This issue is fixed in version 6.5.6. CVE-2026-49855[2]: | Tornado is a Python web framework and asynchronous networking | library. Prior to 6.5.6, Tornado gzip decompression routines | processed limited-size chunks but did not enforce an overall limit | on accumulated decompressed chunks, allowing a malicious server | accessed by SimpleAsyncHTTPClient or an HTTPServer configured with | decompress_request=True to consume effectively unlimited memory. | This issue is fixed in version 6.5.6. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-49853 https://www.cve.org/CVERecord?id=CVE-2026-49853 [1] https://security-tracker.debian.org/tracker/CVE-2026-49854 https://www.cve.org/CVERecord?id=CVE-2026-49854 [2] https://security-tracker.debian.org/tracker/CVE-2026-49855 https://www.cve.org/CVERecord?id=CVE-2026-49855 Regards, Salvatore
