SB2026103128 - Ubuntu update for python-tornado
Published: October 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 vulnerabilities.
1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2023-54397)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform HTTP request smuggling.
The vulnerability exists due to inconsistent interpretation of HTTP requests in tornado/http1connection.py when parsing Content-Length fields and chunk lengths containing non-standard characters. A remote attacker can send a specially crafted request to perform HTTP request smuggling.
Exploitation requires Tornado to be deployed behind certain proxies that interpret those non-standard characters differently.
2) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2024-14029)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform HTTP request smuggling.
The vulnerability exists due to inconsistent interpretation of HTTP requests in the Tornado HTTP request parser when processing requests with multiple Transfer-Encoding: chunked headers. A remote attacker can send a specially crafted request to perform HTTP request smuggling.
Exploitation requires Tornado to be deployed behind a proxy server that forwards requests containing multiple Transfer-Encoding: chunked headers.
3) Resource exhaustion (CVE-ID: CVE-2026-91990)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the parse_multipart_form_data function in httputil.py when processing multipart/form-data requests. A remote attacker can send a multipart request containing numerous parts to cause a denial of service.
4) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-91992)
CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to failure to clear sensitive state in CurlAsyncHTTPClient when reusing pycurl handles for requests with differing per-request options. A remote attacker can cause a subsequent request to be directed to an attacker-controlled host or proxy to disclose sensitive information.
Exploitation depends on a shared client reusing a handle after requests use different client certificate or proxy credential settings.
5) Improper handling of highly compressed data (CVE-ID: CVE-2026-103262)
CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of highly compressed data in tornado.curl_httpclient.CurlAsyncHTTPClient when processing a gzip-compressed response from an attacker-controlled URL. A remote attacker can serve a decompression bomb to cause a denial of service.
The issue affects applications configured to use the curl HTTP client.
6) Path traversal (CVE-ID: CVE-2026-103263)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper path validation in tornado.web.StaticFileHandler when handling requests for paths that resolve through symbolic links. A remote attacker can request a path to a symbolic link within the static root to disclose sensitive information.
Exploitation requires a symbolic link within the static root that points outside that root.
Remediation
Install update from vendor's website.