There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip
    decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated
    decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer
    configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in
    version 6.5.6. (CVE-2026-49855)

The version of the Tornado Python library installed on the remote host is prior to 6.5.6. It is, therefore, affected by multiple vulnerabilities:

  - When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites     the URL, decrements max_redirects, and removes only the Host header. It does not clear Authorization,     auth_username, auth_password, or auth_mode when the redirect target changes origin. As a result,     credentials intended for one origin can be forwarded to a different origin when follow_redirects=True,     which is the default. (CVE-2026-49853)

  - Tornado's gzip decompression routines work in limited-size chunks, but have no overall limit for the     total size of decompressed chunks that they will accumulate (There has always been a limit for the total     compressed size). This allows a malicious server to consume effectively unlimited amounts of memory if     it is accessed via SimpleAsyncHTTPClient in its default configuration. (CVE-2026-49855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22373-1 advisory.

    This update for python-tornado6 fixes the following issues

    - CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient     (bsc#1268395).
    - CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
    - CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2725-1 advisory.

    This update for python-tornado6 fixes the following issues

    - CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient     (bsc#1268395).
    - CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
    - CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip     decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated     decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer     configured with decompress_request=True to consume effectively unlimited memory. This issue is fixed in     version 6.5.6. (CVE-2026-49855)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21067-1 advisory.

    This update for python-tornado6 fixes the following issues

    - CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient     (bsc#1268395).
    - CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
    - CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2726-1 advisory.

    This update for python-tornado fixes the following issues

    - CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient     (bsc#1268395).
    - CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
    - CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
443227	SCA: security update for tornado (GHSA-mgf9-4vpg-hj56)	Tenable Self-Hosted Container Security	SCA Checks	6/16/2026	7/15/2026	high
443227	SCA: security update for tornado (GHSA-mgf9-4vpg-hj56)	Tenable Cloud Security	SCA Checks	6/16/2026	7/15/2026	high
321525	Python Library Tornado < 6.5.6 Multiple Vulnerabilities	Nessus	Misc.	6/19/2026	6/22/2026	high
324858	SUSE SLES16 Security Update : python-tornado6 (SUSE-SU-2026:22373-1)	Nessus	SuSE Local Security Checks	7/2/2026	7/15/2026	high
325033	SUSE SLED15 / SLES15 Security Update : python-tornado6 (SUSE-SU-2026:2725-1)	Nessus	SuSE Local Security Checks	7/3/2026	7/15/2026	high
327205	Linux Distros Unpatched Vulnerability : CVE-2026-49855	Nessus	Misc.	7/16/2026	7/16/2026	high
324049	openSUSE 16 Security Update : python-tornado6 (openSUSE-SU-2026:21067-1)	Nessus	SuSE Local Security Checks	7/1/2026	7/15/2026	high
325027	SUSE SLED15 / SLES15 Security Update : python-tornado (SUSE-SU-2026:2726-1)	Nessus	SuSE Local Security Checks	7/3/2026	7/15/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high