Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-tornado-docUpgrade python-tornadoUpgrade python3-tornadoUpgrade python3-tornado-debuginfoUpgrade python3-tornado-docUpgrade python-tornado-debuginfo | Aug 5, 2026 | Aug 5, 2026 |
| Amazon_linux_2023 | — | Upgrade python3.13-tornado-debugsourceUpgrade python-tornado-docUpgrade python3.13-tornado-debuginfoUpgrade python3-tornadoUpgrade python3-tornado-debuginfoUpgrade python-tornado-debugsourceUpgrade python3.13-tornado-docUpgrade python3.13-tornado | Aug 10, 2026 | Jul 14, 2026 |
| Redhat_linux | — | No solution exists | Jul 20, 2026 | Jul 14, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 6, 2026 | Jul 14, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub