Vulnerability Description
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/tornadoweb/tornado/commit/96dc88c2a05705287856b2cd6b4b4034f9a
- https://github.com/tornadoweb/tornado/pull/3626
- https://github.com/tornadoweb/tornado/releases/tag/v6.5.6
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9
FAQ
What is CVE-2026-49854?
CVE-2026-49854 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argume...
How severe is CVE-2026-49854?
CVE-2026-49854 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-49854?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.