Tornado has out-of-bounds memory access via C extension

TRUNG BÌNH 5.3CVE-2026-49854 · GHSA-cx3h-4qpv-8hc9 · PYSEC-2026-3388 · Công bố 14/07/2026 · cập nhật 24/10/2026

Tóm tắt nhanh

CVE-2026-49854 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng tornado.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.42%, cao hơn 36.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 6.5.6 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
tornado PyPI	`< 6.5.6`	`6.5.6`

Mô tả

Summary

Tornado's optional native extension tornado.speedups implements websocket_mask without validating that the mask argument is exactly four bytes long. The C function reads four bytes from mask unconditionally, even when Python passes a shorter byte string. This can read beyond the provided buffer, exposing up to 3 bytes of uninitialized memory.

The behavior is reachable from Tornado's XSRF token decoder when xsrf_cookies=True and the native extension is active.

Mitigations

This bug is fixed in Tornado 6.5.6. Prior to upgrading to this version, setting the environment variable TORNADO_EXTENSION=0 will disable the vulnerable code (at the expense of reducing websocket performance).

Mô tả của NVD

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.