Source: python-tornado Version: 6.5.5-5 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for python-tornado. CVE-2026-115927[0]: | Tornado is a Python web framework and asynchronous networking | library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer | encoding by processing body data that has already arrived without | yielding to the event loop. A remote unauthenticated peer can send | millions of one-byte chunks to monopolize the process event loop and | stall every other connection served by that process, while lowering | max_body_size only limits the duration of each request. For handlers | that do not use @stream_request_body, retaining each chunk as a | separate object can consume roughly twenty times the received body | size, and SimpleAsyncHTTPClient has the same event-loop behavior | when reading a response from a malicious server. This issue is fixed | in version 6.6.0. CVE-2026-116577[1]: | Tornado is a Python web framework and asynchronous networking | library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete | line folding and repeatedly concatenates short continuation lines, | causing quadratic CPU consumption on the IOLoop thread. An | unauthenticated client can submit a header block containing many | obsolete line-folding continuations before application code runs, | blocking other connections served by the process. The cost grows | with max_header_size, and only availability is affected. This issue | is fixed in version 6.6. CVE-2026-116578[2]: | Tornado is a Python web framework and asynchronous networking | library. Prior to 6.6, tornado.web.RedirectHandler URL templates can | place regex-capture substitutions where crafted request paths change | the redirect scheme or network location. Affected placements include | substitutions at the start of a path, directly after a fixed host, | or at the beginning of the template, including protocol-relative, | absolute, backslash, encoded, host-extension, and user-info variants | interpreted by browsers as attacker-controlled destinations. Static | templates and substitutions after a fixed host followed by a slash | are not affected. An attacker can use the resulting open redirect on | the application's domain for phishing. This issue is fixed in | version 6.6. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-115927 https://www.cve.org/CVERecord?id=CVE-2026-115927 [1] https://security-tracker.debian.org/tracker/CVE-2026-116577 https://www.cve.org/CVERecord?id=CVE-2026-116577 [2] https://security-tracker.debian.org/tracker/CVE-2026-116578 https://www.cve.org/CVERecord?id=CVE-2026-116578 Regards, Salvatore
