Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.

An update of the python3 package has been released.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2016 advisory.

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6,     SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving     Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host,     or port. This issue is fixed in version 6.5.6. (CVE-2026-49853)

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native     extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly     four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached     through Tornado XSRF token decoding with the native extension active. This issue is fixed in version     6.5.6. (CVE-2026-49854)

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip     decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated     decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer     configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in     version 6.5.6. (CVE-2026-49855)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3846 advisory.

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6,     SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving     Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host,     or port. This issue is fixed in version 6.5.6. (CVE-2026-49853)

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native     extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly     four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached     through Tornado XSRF token decoding with the native extension active. This issue is fixed in version     6.5.6. (CVE-2026-49854)

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip     decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated     decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer     configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in     version 6.5.6. (CVE-2026-49855)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2015 advisory.

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6,     SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving     Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host,     or port. This issue is fixed in version 6.5.6. (CVE-2026-49853)

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native     extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly     four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached     through Tornado XSRF token decoding with the native extension active. This issue is fixed in version     6.5.6. (CVE-2026-49854)

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip     decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated     decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer     configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in     version 6.5.6. (CVE-2026-49855)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python-tornado installed on the remote host is prior to 4.2.1-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3847 advisory.

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6,     SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving     Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host,     or port. This issue is fixed in version 6.5.6. (CVE-2026-49853)

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native     extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly     four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached     through Tornado XSRF token decoding with the native extension active. This issue is fixed in version     6.5.6. (CVE-2026-49854)

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip     decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated     decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer     configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in     version 6.5.6. (CVE-2026-49855)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native     extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly     four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached     through Tornado XSRF token decoding with the native extension active. This issue is fixed in version     6.5.6. (CVE-2026-49854)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2725-1 advisory.

    This update for python-tornado6 fixes the following issues

    - CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient     (bsc#1268395).
    - CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
    - CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2726-1 advisory.

    This update for python-tornado fixes the following issues

    - CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient     (bsc#1268395).
    - CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
    - CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22373-1 advisory.

    This update for python-tornado6 fixes the following issues

    - CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient     (bsc#1268395).
    - CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
    - CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21067-1 advisory.

    This update for python-tornado6 fixes the following issues

    - CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient     (bsc#1268395).
    - CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
    - CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native
    extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly
    four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached
    through Tornado XSRF token decoding with the native extension active. This issue is fixed in version
    6.5.6. (CVE-2026-49854)

ID	Name	Product	Family	Type	Severity
333837	Photon OS 5.0: Python3 PHSA-2026-5.0-92-0939	Nessus	PhotonOS Local Security Checks	Local	high
332363	Photon OS 5.0: Python3 PHSA-2026-5.0-0939	Nessus	PhotonOS Local Security Checks	Local	high
332054	Amazon Linux 2023 : python3-tornado (ALAS2023-2026-2016)	Nessus	Amazon Linux Local Security Checks	Local	high
332034	Amazon Linux 2 : python3-tornado, --advisory ALAS2-2026-3846 (ALAS-2026-3846)	Nessus	Amazon Linux Local Security Checks	Local	high
332024	Amazon Linux 2023 : python3.13-tornado (ALAS2023-2026-2015)	Nessus	Amazon Linux Local Security Checks	Local	high
331981	Amazon Linux 2 : python-tornado, --advisory ALAS2-2026-3847 (ALAS-2026-3847)	Nessus	Amazon Linux Local Security Checks	Local	high
327111	Linux Distros Unpatched Vulnerability : CVE-2026-49854	Nessus	Misc.	Local	medium
325033	SUSE SLED15 / SLES15 Security Update : python-tornado6 (SUSE-SU-2026:2725-1)	Nessus	SuSE Local Security Checks	Local	high
325027	SUSE SLED15 / SLES15 Security Update : python-tornado (SUSE-SU-2026:2726-1)	Nessus	SuSE Local Security Checks	Local	high
324858	SUSE SLES16 Security Update : python-tornado6 (SUSE-SU-2026:22373-1)	Nessus	SuSE Local Security Checks	Local	high
324049	openSUSE 16 Security Update : python-tornado6 (openSUSE-SU-2026:21067-1)	Nessus	SuSE Local Security Checks	Local	high
443118	SCA: security update for tornado (GHSA-cx3h-4qpv-8hc9)	Tenable Cloud Security	SCA Checks	Local	medium
443118	SCA: security update for tornado (GHSA-cx3h-4qpv-8hc9)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-49854

medium

Tenable Plugins

high

high

high

high

high

high

medium

high

high

high

high

medium

medium