PT-2026-49059 · Pypi · Tornado

Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-49854

OSV

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

Tornado's optional native extension tornado.speedups implements websocket mask without validating that the mask argument is exactly four bytes long. The C function reads four bytes from mask unconditionally, even when Python passes a shorter byte string. This can read beyond the provided buffer, exposing up to 3 bytes of uninitialized memory.

The behavior is reachable from Tornado's XSRF token decoder when xsrf cookies=True and the native extension is active.

Mitigations

This bug is fixed in Tornado 6.5.6. Prior to upgrading to this version, setting the environment variable TORNADO EXTENSION=0 will disable the vulnerable code (at the expense of reducing websocket performance).

Fix

Buffer Over-read

Weakness Enumeration

CWE-126

Related Identifiers

CVE-2026-49854

GHSA-CX3H-4QPV-8HC9

Affected Products

Tornado

References · 4

• https://osv.dev/vulnerability/GHSA-cx3h-4qpv-8hc9 · Vendor Advisory
• https://github.com/tornadoweb/tornado · Note
• https://github.com/tornadoweb/tornado/releases/tag/v6.5.6 · Note
• https://github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9 · Note