CVE-2026-49854: tornadoweb tornado Buffer Over-read
Vulnerability summary
CVE-2026-49854 is a medium (CVSS 5.3) Buffer Over-read vulnerability in tornadoweb tornado. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 34.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 16 · Related 16Timeline
- 14-07-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · PypiEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
+0.08 pp
From 0.34% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard6 products
- airflow-2All versions (No fix recorded)
- airflow-3< 3.2.2-r4
- litellm< 1.88.1-r2
- mitmproxy< 12.2.3-r1
- tensorflow-cpu-jupyter< 2.21.0-r5
Wolfi2 products
- airflow-3< 3.2.2-r4
- mitmproxy< 12.2.3-r1
Debian1 product
- python-tornadoAll versions (No fix recorded)
PyPI1 product
- tornado< 6.5.6
Tornadoweb1 product
- tornado< 6.5.6
Ubuntu1 product
- python-tornadoAll versions (No fix recorded)
6 vendors · 12 products
References
12 links- github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9X Refsource CONFIRMWEBREPORTAdvisory
- github.com/tornadoweb/tornado/commit/96dc88c2a05705287856b2cd6b4b4034f9a6aaacX Refsource MISCREPORTFIX
- pypi.org/project/tornadoPACKAGE
