Hi,
The following vulnerabilities were published for python-tornado.
CVE-2026-115927[0]:
| Tornado is a Python web framework and asynchronous networking
| library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer
| encoding by processing body data that has already arrived without
| yielding to the event loop. A remote unauthenticated peer can send
| millions of one-byte chunks to monopolize the process event loop and
| stall every other connection served by that process, while lowering
| max_body_size only limits the duration of each request. For handlers
| that do not use @stream_request_body, retaining each chunk as a
| separate object can consume roughly twenty times the received body
| size, and SimpleAsyncHTTPClient has the same event-loop behavior
| when reading a response from a malicious server. This issue is fixed
| in version 6.6.0.
CVE-2026-116577[1]:
| Tornado is a Python web framework and asynchronous networking
| library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete
| line folding and repeatedly concatenates short continuation lines,
| causing quadratic CPU consumption on the IOLoop thread. An
| unauthenticated client can submit a header block containing many
| obsolete line-folding continuations before application code runs,
| blocking other connections served by the process. The cost grows
| with max_header_size, and only availability is affected. This issue
| is fixed in version 6.6.
CVE-2026-116578[2]:
| Tornado is a Python web framework and asynchronous networking
| library. Prior to 6.6, tornado.web.RedirectHandler URL templates can
| place regex-capture substitutions where crafted request paths change
| the redirect scheme or network location. Affected placements include
| substitutions at the start of a path, directly after a fixed host,
| or at the beginning of the template, including protocol-relative,
| absolute, backslash, encoded, host-extension, and user-info variants
| interpreted by browsers as attacker-controlled destinations. Static
| templates and substitutions after a fixed host followed by a slash
| are not affected. An attacker can use the resulting open redirect on
| the application's domain for phishing. This issue is fixed in
| version 6.6.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-115927
https://www.cve.org/CVERecord?id=CVE-2026-115927
[1] https://security-tracker.debian.org/tracker/CVE-2026-116577
https://www.cve.org/CVERecord?id=CVE-2026-116577
[2] https://security-tracker.debian.org/tracker/CVE-2026-116578
https://www.cve.org/CVERecord?id=CVE-2026-116578
Regards,
Salvatore