Red Hat Security AdvisoryRHSA-2026:90283
python-tornado security update
Released 2026-10-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream EUS (v.9.6) python-tornado-6.4.2-2.el9_6.7, python3-tornado-6.4.2-2.el9_6.7
Fixes 4 records
Priority HIGH 77
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00628 · Published 2026-10-01 · Partial fix · 6.5.9 CWE-409
Priority HIGH 77
Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00424 · Published 2026-09-15 · Partial fix · 6.5.8 CWE-770
Priority MEDIUM 40
Tornado is a Python web framework and asynchronous networking library.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00572 · Published 2026-07-14 · Partial fix · 6.5.6 CWE-409
Priority LOW 34
Tornado is a Python web framework and asynchronous networking library.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00445 · Published 2026-07-14 · Partial fix · 6.5.6 CWE-200
