CVE-2026-49853: tornadoweb tornado
CVSS: 7.7v3.1HighDeferred
AliasesGHSA-3x9g-8vmp-wqvfPYSEC-2026-3387UBUNTU-CVE-2026-49853DEBIAN-CVE-2026-49853CGA-2529-m78h-xf34CGA-6xxp-rjvj-crf6CGA-fr44-w2rg-95h7CGA-r3gh-pq3f-xqq8
Published 14-07-2026Last modified 21-07-2026
Vulnerability summary
CVE-2026-49853 is a high (CVSS 7.7) vulnerability in tornadoweb tornado. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.9% of scored vulnerabilities.
CVSS score
7.7/10
010
High · v3.1 (CVE.org)EPSS score
0.45%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 19 · Related 16MGASA-2026-0467OPENSUSE-SU-2026:11027-1OPENSUSE-SU-2026:21067-1RHSA-2026:67146RHSA-2026:67147RHSA-2026:80741SUSE-SU-2026:22286-1SUSE-SU-2026:22373-1SUSE-SU-2026:22430-1SUSE-SU-2026:22445-1SUSE-SU-2026:2725-1SUSE-SU-2026:2726-1SUSE-SU-2026:3291-1SUSE-SU-2026:4580-1SUSE-SU-2026:4581-1SUSE-SU-2026:4582-1SUSE-SU-2026:4583-1SUSE-SU-2026:4584-1SUSE-SU-2026:4585-1CGA-9P8V-Q7J8-X8X2
Timeline
- 14-07-2026PublishedVulnerability first disclosed.
- 21-07-2026Last modifiedVulnerability information updated.
Description
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.7Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NSourcesAll 7 agree
- OSV · PypiEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- NVDNIST7.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS trend
Probability
0.45%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
+0.01 pp
From 0.45% on 19-09-2026
19-09-202619-10-2026
EPSS score0.45%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard2 products
- airflow-2All versions (No fix recorded)
- mitmproxy< 12.2.3-r1
Debian1 product
- python-tornadoAll versions (No fix recorded)
PyPI1 product
- tornado< 6.5.6
Tornadoweb1 product
- tornado< 6.5.6
Ubuntu1 product
- python-tornadoAll versions (No fix recorded)
Wolfi1 product
- mitmproxy< 12.2.3-r1
6 vendors · 7 products
References
12 links- github.com/tornadoweb/tornado/security/advisories/GHSA-3x9g-8vmp-wqvfX Refsource CONFIRMWEBREPORTAdvisory
- github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751X Refsource MISCREPORTFIX
- pypi.org/project/tornadoPACKAGE
