CVE-2026-49854 | Tornado is a Python web framework and asynchronous networkin… | CVSS 5.3 MEDIUM

Description

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.

Metadata

CVE ID: CVE-2026-49854
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-01 22:03 UTC
Published: 2026-07-14 20:43 UTC
Last updated: 2026-07-14 20:43 UTC
Primary CWE: CWE-126
CWE-126: Buffer Over-read
Vendor / Product: tornadoweb / tornado
Sources: cve.org · NVD

Severity & Metrics

5.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products (1)

Vendor	Product	Platform	Versions
tornadoweb	tornado	—	< 6.5.6

Weakness (CWE)

CWE	Source	Description
CWE-126	cna	CWE-126: Buffer Over-read

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References (4)

https://github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9 https://github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9
https://github.com/tornadoweb/tornado/pull/3626 https://github.com/tornadoweb/tornado/pull/3626
https://github.com/tornadoweb/tornado/commit/96dc88c2a05705287856b2cd6b4b4034f9a6aaac https://github.com/tornadoweb/tornado/commit/96dc88c2a05705287856b2cd6b4b4034f9a6aaac
https://github.com/tornadoweb/tornado/releases/tag/v6.5.6 https://github.com/tornadoweb/tornado/releases/tag/v6.5.6