What is the CVSS score of CVE-2026-49854?

CVE-2026-49854 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-49854?

Yes, a patch is available for CVE-2026-49854. Update the affected software to the latest version immediately.

Tornado CVE-2026-49854

EUVD-2026-44504 MEDIUM

Buffer Over-read (CWE-126)

2026-06-12 https://github.com/tornadoweb/tornado

GHSA-cx3h-4qpv-8hc9 PYSEC-2026-3388

Buffer Overflow Python Red Hat Suse

5.3

CVSS 3.1 · Vendor: https://github.com/tornadoweb/tornado

Severity by source

Vendor (https://github.com/tornadoweb/tornado) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.7 LOW

Network-reachable via WebSocket but AC:H due to dual prerequisite (C extension active + xsrf_cookies=True); only low confidentiality from 3-byte uninitialized memory leak; no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (https://github.com/tornadoweb/tornado).

CVSS VectorVendor: https://github.com/tornadoweb/tornado

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Jul 14, 2026 - 21:22 NVD

LOW MEDIUM

CVSS changed

Jul 14, 2026 - 21:22 NVD

3.7 (LOW) 5.3 (MEDIUM)

Source Code Evidence Fetched

Jun 12, 2026 - 18:52 vuln.today

Analysis Generated

Jun 12, 2026 - 18:52 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 pypi packages depend on tornado (2 direct, 4 indirect)

Ecosystem-wide dependent count for version 6.5.6.

DescriptionCVE.org

Summary

Tornado's optional native extension tornado.speedups implements websocket_mask without validating that the mask argument is exactly four bytes long. The C function reads four bytes from mask unconditionally, even when Python passes a shorter byte string. This can read beyond the provided buffer, exposing up to 3 bytes of uninitialized memory.

The behavior is reachable from Tornado's XSRF token decoder when xsrf_cookies=True and the native extension is active.

Mitigations

This bug is fixed in Tornado 6.5.6. Prior to upgrading to this version, setting the environment variable TORNADO_EXTENSION=0 will disable the vulnerable code (at the expense of reducing websocket performance).

AnalysisAI

Out-of-bounds memory read in Tornado's optional C extension tornado.speedups exposes up to 3 bytes of uninitialized memory via a missing length validation in the websocket_mask function. Applications running Tornado versions prior to 6.5.6 with the native extension active and xsrf_cookies=True are reachable from the network without authentication (CVSS AV:N/PR:N), though high attack complexity (AC:H) is indicated by the dual configuration prerequisite. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS stands at 0.04% (11th percentile), consistent with the low exploitation probability for a constrained information-disclosure primitive. Vendor-released patch is Tornado 6.5.6.

Technical ContextAI

Tornado (pip package tornado) is a Python asynchronous web framework. Its optional native C extension tornado.speedups accelerates WebSocket operations, including the websocket_mask function that applies the RFC 6455 four-byte XOR mask to WebSocket frame payloads. The root cause is CWE-126 (Buffer Over-read): the C implementation reads exactly four bytes from the mask argument unconditionally, without first verifying that the caller-supplied mask byte string is at least four bytes long. When Python passes a shorter buffer - a condition reachable via Tornado's XSRF token decoder when xsrf_cookies=True is set - the C function reads one to three bytes beyond the end of the allocated Python bytes object, accessing uninitialized heap or stack memory. The affected CPE is pkg:pip/tornado for all versions below 6.5.6.

RemediationAI

The primary remediation is upgrading to Tornado 6.5.6, which introduces proper length validation on the mask argument in the C extension. The release is available via PyPI (pip install tornado==6.5.6) and at https://github.com/tornadoweb/tornado/releases/tag/v6.5.6. For deployments that cannot upgrade immediately, setting the environment variable TORNADO_EXTENSION=0 before process startup disables the tornado.speedups C extension entirely, routing all WebSocket masking through the pure-Python fallback. The trade-off is a measurable reduction in WebSocket throughput performance; the severity of the performance impact depends on WebSocket traffic volume in the deployment. No other compensating controls (such as WAF rules or network restrictions) would reliably prevent exploitation, since the vulnerable code path is reachable via ordinary WebSocket frame processing.

More in Python

View all

CVE-2025-24016 CRITICAL Act Now POC

9.9 Feb 10

Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t

CVE-2025-27520 CRITICAL Act Now POC

9.8 Apr 04

BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser

CVE-2025-2945 CRITICAL Act Now POC

9.9 Apr 03

pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi

CVE-2013-5093 MEDIUM This Month POC

6.8 Sep 27

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python

CVE-2025-32375 CRITICAL Act Now POC

9.8 Apr 09

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2024-21644 HIGH Act Now POC

7.5 Jan 08

pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.

CVE-2026-33017 CRITICAL Act Now POC

9.3 Mar 17

Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301

CVE-2017-9462 HIGH Act Now POC

8.8 Jun 06

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse

CVE-2026-49869 CRITICAL Act Now POC

10.0 Jun 26

Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to

CVE-2026-39987 CRITICAL Act Now POC

9.3 Apr 08

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/

CVE-2024-21645 MEDIUM This Month POC

5.3 Jan 08

pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne

Same weakness CWE-126 – Buffer Over-read

View all

CVE-2017-7668 HIGH

7.5

CVE-2017-7679 CRITICAL POC

9.8

CVE-2021-34584 CRITICAL POC

9.1

CVE-2022-1987 HIGH POC

8.1

CVE-2022-1908 HIGH POC

8.1

CVE-2022-1907 HIGH POC

8.1

CVE-2026-64905 HIGH

7.8

CVE-2023-0817 HIGH POC

7.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Low

Product	Status
Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.4.9.22.2 Container suse/multi-linux-manager/5.1/x86_64/server-saline:5.1.4.9.22.1 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.4.8.22.1 Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE	Affected
Container suse/sl-micro/6.0/base-os-container:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE	Affected
Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE	Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed

CVE-2026-49854 vulnerability details – vuln.today

Back

Tornado CVE-2026-49854

Severity by source

CVSS VectorVendor: https://github.com/tornadoweb/tornado

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

Summary

Mitigations

AnalysisAI

Technical ContextAI

RemediationAI

More in Python

Same weakness CWE-126 – Buffer Over-read

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code