Executive brief
Tornado is a popular Python web framework used for building high-performance web applications. A security flaw in its optional performance-enhancing component could allow an attacker to trigger an improper memory read. This could potentially expose small amounts of sensitive internal memory, though it does not allow for full system takeover or data modification.
Technical details
A buffer over-read vulnerability (CWE-126) exists in Tornado's optional C extension, tornado.speedups. The websocket_mask function fails to validate that the mask argument is exactly four bytes long, leading the underlying C function to read up to three bytes beyond the provided buffer. This vulnerability is reachable via the XSRF token decoding process when xsrf_cookies is enabled and the native extension is active. An unauthenticated remote attacker can exploit this to read small amounts of uninitialized memory. The issue is resolved in version 6.5.6; users can mitigate the risk by setting TORNADO_EXTENSION=0 to disable the native extension.
Affected products
- Tornadoweb Tornado < 6.5.6
Timeline
- 2026-05-27: patched: Version 6.5.6 released
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-07-14: disclosed: CVE published to NVD