SB20261109159 - Multiple vulnerabilities in Tornado

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109159

SB20261109159 - Multiple vulnerabilities in Tornado

Published: November 9, 2026 Updated: November 10, 2026

Security Bulletin ID SB20261109159
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

High 20% Medium 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Path traversal (CVE-ID: CVE-2026-123534)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to obtain file hashes outside the static directory and indefinitely block affected Tornado servers.

The vulnerability exists due to missing path containment checks in static_url() when applications pass untrusted input as its path argument, allowing traversal outside static_path. An unauthenticated remote attacker can submit traversal paths to obtain SHA-512 hashes of server-readable files or target /dev/zero to block the event loop indefinitely.


2) Resource exhaustion (CVE-ID: CVE-2026-115927)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to deny service to other connections handled by a Tornado server process.

The vulnerability exists due to Tornado's HTTP/1.1 body parser processing all available chunks without yielding to the event loop when reading chunked request bodies. An unauthenticated remote attacker can send millions of one-byte chunks to a handler that reads the request body, blocking the process for close to a minute per request.


3) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2026-123535)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to alter cookie attributes and widen a cookie's scope to parent paths or other subdomains.

The vulnerability exists due to missing validation of the max_age argument in Tornado's RequestHandler.set_cookie when applications pass attacker-influenced strings without first converting them to integers. An unauthenticated remote attacker can supply a string containing additional cookie attributes that are incorporated into the resulting Set-Cookie header.


4) Open redirect (CVE-ID: CVE-2026-116578)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to redirect users from an affected application's domain to an attacker-controlled site for phishing.

The vulnerability exists due to insufficient validation of request-path substitutions in Tornado's RedirectHandler when a configured URL template lets captured input influence the redirect scheme or host. An unauthenticated remote attacker can craft a link that sends a victim who follows it to a chosen external host.


5) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-116577)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to degrade Tornado HTTP service by consuming CPU and blocking other connections served by the same process.

The vulnerability exists due to quadratic processing time in Tornado's HTTP header parser when a header value spans many obsolete line-folded continuation lines. An unauthenticated remote attacker can send repeated requests containing these lines to stall the event loop without authentication or victim interaction.


Remediation

Install update from vendor's website.

References