What’s Vulnerable › Vulnerabilities

CVE-2026-49854: Tornado: Out-of-bounds memory access in C extension

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-14 · updated 2026-10-24
• Weakness: CWE-126

Description

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.

Affected products

• Pypi Tornado: before 6.5.6; 0.2, 1.0, 1.1, 1.1.1, 1.2, 1.2.1 (+75) — fixed in 6.5.6
• tornadoweb tornado: before 6.5.6

How to fix

Upgrade to a fixed version: Pypi Tornado 6.5.6. Check the vendor advisory for mitigations.

References

• https://github.com/tornadoweb/tornado/commit/96dc88c2a05705287856b2cd6b4b4034f9a6aaac
• https://github.com/tornadoweb/tornado/pull/3626
• https://github.com/tornadoweb/tornado/releases/tag/v6.5.6
• https://github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9

Get alerted when CVE-2026-49854 or the next vulnerability affects your stack