SB2026101250 - Red Hat Enterprise Linux 10 update for python-tornado

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101250

SB2026101250 - Red Hat Enterprise Linux 10 update for python-tornado

Published: October 12, 2026

Security Bulletin ID SB2026101250
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Information disclosure (CVE-ID: CVE-2026-49853)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose credentials intended for one origin to a different origin.

The vulnerability exists due to improper handling of authorization headers in SimpleAsyncHTTPClient when following cross-origin 3xx redirects. A remote user can cause the client to forward authorization credentials to a different origin.

Redirect following is enabled by default.


2) Improper handling of highly compressed data (CVE-ID: CVE-2026-49855)

CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of highly compressed data in Tornado gzip decompression routines when SimpleAsyncHTTPClient processes a response from a malicious server. A remote attacker can provide a compressed response that expands to consume effectively unlimited memory to cause a denial of service.

SimpleAsyncHTTPClient is affected in its default configuration. HTTPServer is affected only when decompress_request=True is set.


3) Resource exhaustion (CVE-ID: CVE-2026-91990)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the parse_multipart_form_data function in httputil.py when processing multipart/form-data requests. A remote attacker can send a multipart request containing numerous parts to cause a denial of service.


Remediation

Install update from vendor's website.

References