SB20261111208 - openEuler 24.03 LTS SP3 update for python-tornado

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261111208

SB20261111208 - openEuler 24.03 LTS SP3 update for python-tornado

Published: November 11, 2026

Security Bulletin ID SB20261111208
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Partial DoS

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Resource exhaustion (CVE-ID: CVE-2026-115927)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to deny service to other connections handled by a Tornado server process.

The vulnerability exists due to Tornado's HTTP/1.1 body parser processing all available chunks without yielding to the event loop when reading chunked request bodies. An unauthenticated remote attacker can send millions of one-byte chunks to a handler that reads the request body, blocking the process for close to a minute per request.


2) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-116577)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to degrade Tornado HTTP service by consuming CPU and blocking other connections served by the same process.

The vulnerability exists due to quadratic processing time in Tornado's HTTP header parser when a header value spans many obsolete line-folded continuation lines. An unauthenticated remote attacker can send repeated requests containing these lines to stall the event loop without authentication or victim interaction.


3) Open redirect (CVE-ID: CVE-2026-116578)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to redirect users from an affected application's domain to an attacker-controlled site for phishing.

The vulnerability exists due to insufficient validation of request-path substitutions in Tornado's RedirectHandler when a configured URL template lets captured input influence the redirect scheme or host. An unauthenticated remote attacker can craft a link that sends a victim who follows it to a chosen external host.


Remediation

Install update from vendor's website.

References