CVE-2026-49854

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/tornadoweb/tornado/commit/96dc88c2a05705287856b2cd6b4b4034f9a6aaac
https://github.com/tornadoweb/tornado/pull/3626
https://github.com/tornadoweb/tornado/releases/tag/v6.5.6
https://github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9

Configurations

No configuration.

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Tornado es un framework web de Python y una biblioteca de red asíncrona. Antes de la 6.5.6, la extensión nativa opcional tornado.speedups implementaba websocket_mask sin validar que el argumento mask fuera exactamente de cuatro bytes, permitiendo que la función C leyera hasta tres bytes más allá del búfer proporcionado cuando se accedía a ella a través de la decodificación de tokens XSRF de Tornado con la extensión nativa activa. Este problema se solucionó en la versión 6.5.6.

Information

Published : 2026-07-14 21:17

Updated : 2026-10-24 21:10

NVD link : CVE-2026-49854

Mitre link : CVE-2026-49854

CVE.ORG link : CVE-2026-49854

JSON object : View

Products Affected

No product.

CWE

CWE-126

Buffer Over-read

{"id": "CVE-2026-49854", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49854", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T13:23:13.452445Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "tornadoweb", "product": "tornado", "versions": [{"status": "affected", "version": "< 6.5.6"}]}]}], "published": "2026-07-14T21:17:02.300", "references": [{"url": "https://github.com/tornadoweb/tornado/commit/96dc88c2a05705287856b2cd6b4b4034f9a6aaac", "source": "security-advisories@github.com"}, {"url": "https://github.com/tornadoweb/tornado/pull/3626", "source": "security-advisories@github.com"}, {"url": "https://github.com/tornadoweb/tornado/releases/tag/v6.5.6", "source": "security-advisories@github.com"}, {"url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-126"}]}], "descriptions": [{"lang": "en", "value": "Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6."}, {"lang": "es", "value": "Tornado es un framework web de Python y una biblioteca de red as\u00edncrona. Antes de la 6.5.6, la extensi\u00f3n nativa opcional tornado.speedups implementaba websocket_mask sin validar que el argumento mask fuera exactamente de cuatro bytes, permitiendo que la funci\u00f3n C leyera hasta tres bytes m\u00e1s all\u00e1 del b\u00fafer proporcionado cuando se acced\u00eda a ella a trav\u00e9s de la decodificaci\u00f3n de tokens XSRF de Tornado con la extensi\u00f3n nativa activa. Este problema se solucion\u00f3 en la versi\u00f3n 6.5.6."}], "lastModified": "2026-10-24T21:10:00.130", "sourceIdentifier": "security-advisories@github.com"}