CVE-2026-49853 Details
Description
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.
A vulnerability exists in Tornado's SimpleAsyncHTTPClient in versions prior to 6.5.6, where the client improperly handles HTTP redirects. When following a redirect that changes the scheme, host, or port, the client removes only the Host header, leaving sensitive headers such as Authorization, auth_username, auth_password, and auth_mode intact. This behavior can lead to the unintended forwarding of credentials to a different origin. The issue is addressed in Tornado version 6.5.6, which aligns the header handling with that of CurlAsyncHTTPClient, removing Authorization and Cookie headers on cross-origin redirects.
Users can upgrade to Tornado version 6.5.6 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 14, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751 | [email protected] | Source CodeVendor |
| https://github.com/tornadoweb/tornado/pull/3626 | [email protected] | Source CodeVendor |
| https://github.com/tornadoweb/tornado/releases/tag/v6.5.6 | [email protected] | Release NotesVendor |
| https://github.com/tornadoweb/tornado/security/advisories/GHSA-3x9g-8vmp-wqvf | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tornado | < 6.5.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |