Medium severity · published Jul 14, 2026
CVE-2026-49854
Tornado: Out-of-bounds memory access in C extension
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TO
tornado · tornadoweb
< 6.5.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-49854
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-49854
github.com
https://github.com/tornadoweb/tornado/commit/96dc88c2a05705287856b2cd6b4b4034f9a6aaac
github.com
https://github.com/tornadoweb/tornado/pull/3626
github.com
https://github.com/tornadoweb/tornado/releases/tag/v6.5.6
github.com
https://github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9
More from tornado
7.7
CVE-2026-49853
Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
7.5
CVE-2026-103262
Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient
7.5
CVE-2026-91990
Tornado before 6.5.8 Memory Amplification DoS via multipart
7.5
CVE-2024-14029
Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
7.5
CVE-2023-54397
Tornado before 6.3.3 HTTP Request Smuggling via Content-Length