Sign in
Deutsch English Español Polski
Low

Tornado has out-of-bounds memory access via C extension

  • Disclosed: 12.06.2026
  • Updated: 11.10.2026 15:17

Summary

Tornado's optional native extension tornado.speedups implements websocket_mask without validating that the mask argument is exactly four bytes long. The C function reads four bytes from mask unconditionally, even when Python passes a shorter byte string. This can read beyond the provided buffer, exposing up to 3 bytes of uninitialized memory.

The behavior is reachable from Tornado's XSRF token decoder when xsrf_cookies=True and the native extension is active.

Mitigations

This bug is fixed in Tornado 6.5.6. Prior to upgrading to this version, setting the environment variable TORNADO_EXTENSION=0 will disable the vulnerable code (at the expense of reducing websocket performance).

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) tornado < 6.5.6 6.5.6

References

CVSS score 3.7/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE)
CWE-126
Platform
Python (PyPI)
Package
tornado
Disclosed
12.06.2026
Updated
11.10.2026 15:17

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-3388 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-cx3h-4qpv-8hc9 - CC BY 4.0

Vulnerability history: tornado

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (23) in the archive
Total entries
23
First → latest
05.2012 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • High 13
  • Medium 8
  • Low 2

Disclosures per year

earlier: 1

Severity:
  1. tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
    High · 7.5 CVE-2026-103262 < 6.5.9 6.5.9
  2. Tornado: StaticFileHandler follows symlinks outside static root (path traversal)
    High CVE-2026-103263 < 6.5.9 6.5.9
  3. Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
    High · 7.5 CVE-2026-82397 < 6.5.8 6.5.8
  4. Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
    High · 7.7 CVE-2026-49853 < 6.5.6 6.5.6
  5. tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)
    High · 7.5 CVE-2026-49855 < 6.5.6 6.5.6
  6. Tornado has out-of-bounds memory access via C extension this entry
    Low · 3.7 CVE-2026-49854 < 6.5.6 6.5.6
  7. Tornado has cookie attribute injection via .RequestHandler.set_cookie
    High · 7.2 CVE-2026-35536 < 6.5.5 6.5.5
  8. Tornado is vulnerable to DoS due to too many multipart parts
    High · 7.5 CVE-2026-31958 < 6.5.5 6.5.5
  9. Tornado: Quadratic DoS via Crafted Multipart Parameters
    High · 7.5 CVE-2025-67726 < 6.5.3 6.5.3
  10. Tornado: Quadratic DoS via Repeated Header Coalescing
    High · 7.5 CVE-2025-67725 < 6.5.3 6.5.3
  11. Tornado vulnerable to excessive logging caused by malformed multipart form data
    High · 7.5 CVE-2025-47287 < 6.5 6.5
  12. Tornado has an HTTP cookie parsing DoS vulnerability
    High · 7.5 CVE-2024-52804 < 6.4.2 6.4.2
  13. Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determin
    High · 6.5 CVE-2014-9720 < 3.2.2 3.2.2
  14. CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting
    High · 7.5 CVE-2012-2374 < 2.2.1 2.2.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.