Red Hat Security AdvisoryRHSA-2026:67146
python-tornado security update
Released 2026-09-14 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) python-tornado-6.5.8-0.el9_8.1, python3-tornado-6.5.8-0.el9_8.1
Fixes 4 records
Priority HIGH 77
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00424 · Published 2026-09-15 · Partial fix · 6.5.8 CWE-770
Priority MEDIUM 40
Tornado is a Python web framework and asynchronous networking library.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00572 · Published 2026-07-14 · Partial fix · 6.5.6 CWE-409
Priority LOW 39
Tornado is a Python web framework and asynchronous networking library.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00346 · Published 2026-08-31 · Partial fix · 6.5.8 CWE-1284
Priority LOW 34
Tornado is a Python web framework and asynchronous networking library.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00445 · Published 2026-07-14 · Partial fix · 6.5.6 CWE-200
