CVE-2026-49854

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.

Scoring

Severity

MEDIUM

CVSS base score

5.3

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS probability

0.34%

CWE

CWE-126

Published

2026-07-14

Last modified

2026-07-15

Affected products

• tornadoweb tornado

Weakness type

• CWE-126

Related vulnerabilities

• CVE-2026-83949 — Microsoft Office Word Information Disclosure Vulnerability
• CVE-2026-83951 — Microsoft Office Word Information Disclosure Vulnerability
• CVE-2026-81399 — Microsoft Excel Information Disclosure Vulnerability
• CVE-2026-78516 — Windows Storage Information Disclosure Vulnerability
• CVE-2026-72974 — Microsoft Office Excel Information Disclosure Vulnerability
• CVE-2026-69626 — Microsoft Office Information Disclosure Vulnerability
• CVE-2026-72932 — Windows Message Queuing Queue Manager Information Disclosure Vulnerability
• CVE-2026-69794 — Windows Encrypting File System (EFS) Information Disclosure Vulnerability

Markdown version · Browse all CVEs