python-tornado security update
Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived connection to each user. Security Fix(es): Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.(CVE-2023-54397) Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization.(CVE-2024-14029) Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.(CVE-2024-58384) Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the ma
OESA-2026-4036
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:OESA-2026-4036
python-tornado
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 6.5.10-1.oe2403sp4
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.5.10-1.oe2403sp4"
}
]
}
],
"package": {
"name": "python-tornado",
"purl": "pkg:rpm/openEuler/python-tornado&distro=openEuler-24.03-LTS-SP4",
"ecosystem": "openEuler:24.03-LTS-SP4"
},
"database_specific": {
"source": "https://repo.openeuler.org/security/data/osv/OESA-2026-4036.json"
},
"ecosystem_specific": {
"src": [
"python-tornado-6.5.10-1.oe2403sp4.src.rpm"
],
"noarch": [
"python-tornado-help-6.5.10-1.oe2403sp4.noarch.rpm"
],
"x86_64": [
"python-tornado-debuginfo-6.5.10-1.oe2403sp4.x86_64.rpm",
"python-tornado-debugsource-6.5.10-1.oe2403sp4.x86_64.rpm",
"python3-tornado-6.5.10-1.oe2403sp4.x86_64.rpm"
],
"aarch64": [
"python-tornado-debuginfo-6.5.10-1.oe2403sp4.aarch64.rpm",
"python-tornado-debugsource-6.5.10-1.oe2403sp4.aarch64.rpm",
"python3-tornado-6.5.10-1.oe2403sp4.aarch64.rpm"
]
}
}
]Publisher severity
high
Source reference: /database_specific/severity
- Event
- #14649 · Revision 1
- Added to Heist Feed
- Publisher date