Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-14T20:43:03 tornado: Tornado: Information disclosure via out-of-bounds read in websocket_mask 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-125

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.

A flaw was found in Tornado, a Python web framework. The optional native extension `tornado.speedups` did not properly validate the `mask` argument in its `websocket_mask` function. This allowed the C function to read beyond the intended buffer, potentially exposing up to three bytes of uninitialized memory. This vulnerability can be triggered when the native extension is active and Tornado's Cross-Site Request Forgery (XSRF) token decoder is in use, leading to information disclosure.

This Moderate vulnerability in the Tornado web framework's optional native extension, `tornado.speedups`, could lead to information disclosure. When the native extension is active and the XSRF token decoder is in use, an out-of-bounds read of up to three bytes of uninitialized memory may occur. This limited data exposure is contingent on specific configurations and does not directly lead to broader system compromise. Exploit Intelligence Fix deferred exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 External Secrets Operator for Red Hat OpenShift Fix deferred external-secrets-operator/bitwarden-sdk-server-rhel9 External Secrets Operator for Red Hat OpenShift Fix deferred external-secrets-operator/external-secrets-operator-bundle External Secrets Operator for Red Hat OpenShift Fix deferred external-secrets-operator/external-secrets-operator-rhel9 External Secrets Operator for Red Hat OpenShift Fix deferred external-secrets-operator/external-secrets-rhel9 Lightspeed Core Fix deferred lightspeed-core/lightspeed-stack-rhel9 Lightspeed Core Fix deferred lightspeed-core/rag-tool-cpu-rhel9 Lightspeed Core Fix deferred lightspeed-core/rag-tool-cuda-12.9-rhel9 Migration Toolkit for Applications 8 Fix deferred mta/mta-solution-server-rhel9 OpenShift Lightspeed Fix deferred openshift-lightspeed/lightspeed-ocp-rag-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-26/lightspeed-chatbot-rhel9 Red Hat Ansible Automation Platform 2 Fix deferred ansible-automation-platform-27/lightspeed-chatbot-rhel9 Red Hat Enterprise Linux 10 Fix deferred python-tornado Red Hat Enterprise Linux 10 Fix deferred rhel10/keylime-registrar Red Hat Enterprise Linux 10 Fix deferred rhel10/keylime-verifier Red Hat Enterprise Linux 7 Out of support scope python-tornado Red Hat Enterprise Linux 8 Fix deferred pcs Red Hat Enterprise Linux 9 Fix deferred python-tornado Red Hat Enterprise Linux 9 Fix deferred rhel9/keylime-registrar Red Hat Enterprise Linux 9 Fix deferred rhel9/keylime-verifier Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rhelai3/disk-image-cuda-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-llama-stack-core-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-trustyai-nemo-guardrails-server-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Fix deferred python-flit Red Hat OpenShift Container Platform 4 Fix deferred python-pep517 Red Hat OpenShift Container Platform 4 Fix deferred python-tornado Red Hat OpenShift Container Platform 4 Fix deferred rhcos https://www.cve.org/CVERecord?id=CVE-2026-49854 https://nvd.nist.gov/vuln/detail/CVE-2026-49854 https://github.com/tornadoweb/tornado/commit/96dc88c2a05705287856b2cd6b4b4034f9a6aaac https://github.com/tornadoweb/tornado/pull/3626 https://github.com/tornadoweb/tornado/releases/tag/v6.5.6 https://github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9