CVE-2026-49854 Details
Description
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.
A moderate severity out-of-bounds memory access vulnerability has been identified in the Tornado web framework, specifically in versions prior to 6.5.6. The issue arises in the optional native extension 'tornado.speedups', which implements a WebSocket masking function without properly validating the length of the mask argument. This oversight allows the function to read up to three bytes beyond the end of the provided buffer. The vulnerability can be triggered through Tornado's XSRF token decoding when the native extension is active and 'xsrf_cookies' is set to true.
Users can upgrade to Tornado version 6.5.6 or later to address this vulnerability. Alternatively, the environment variable 'TORNADO_EXTENSION' can be set to '0' to disable the native extension, although this may impact WebSocket performance.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 14, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tornadoweb/tornado/commit/96dc88c2a05705287856b2cd6b4b4034f9a6aaac | [email protected] | Source CodeVendor |
| https://github.com/tornadoweb/tornado/pull/3626 | [email protected] | Source CodeVendor |
| https://github.com/tornadoweb/tornado/releases/tag/v6.5.6 | [email protected] | Release NotesVendor |
| https://github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-126 | Buffer Over-read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tornado | < 6.5.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |