{"id":"CVE-2026-116578","aliases":["AZL-111736","CLSA-2026-1793872514","CLSA-2026-1794218750","DEBIAN-CVE-2026-116578","EUVD-2026-110319","GHSA-pw9p-v7r6-gx4p","OESA-2026-4798","OESA-2026-4799","OESA-2026-4800","UBUNTU-CVE-2026-116578","openSUSE-SU-2026:12440-1"],"status":"published","title":"Tornado: Open redirect in RedirectHandler via protocol-relative URLs","description":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.","severity":{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00459,"percentile":0.40229,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2026-10-26T20:22:32Z","modified":"2026-11-12T17:25:21Z","fixes":[{"ecosystem":"PyPI","package":"tornado","fixed_in":["6.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.3.3-11"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1"},{"fixed":"6.1.0.post11+tuxcare"}]}],"versions":["6.1","6.1.0.post1+tuxcare","6.1.0.post10+tuxcare","6.1.0.post2+tuxcare","6.1.0.post3+tuxcare","6.1.0.post4+tuxcare","6.1.0.post5+tuxcare","6.1.0.post6+tuxcare","6.1.0.post7+tuxcare","6.1.0.post8+tuxcare","6.1.0.post9+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.1"},{"fixed":"5.1.1.post7+tuxcare"}]}],"versions":["5.1.1","5.1.1.post1+tuxcare","5.1.1.post2+tuxcare","5.1.1.post3+tuxcare","5.1.1.post4+tuxcare","5.1.1.post5+tuxcare","5.1.1.post6+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-3","6.2.0-3+deb12u1","6.2.0-3+deb12u2","6.2.0-3+deb12u3","6.2.0-3+deb12u4","6.3.2-1","6.4.0-1","6.4.0-2","6.4.1-1","6.4.1-2","6.4.1-3","6.4.2-1","6.4.2-2","6.4.2-3","6.5.2-1","6.5.2-2","6.5.2-3","6.5.4-0.1","6.5.4-1","6.5.5-1","6.5.5-2","6.5.5-3","6.5.5-4","6.5.5-5","6.6.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.2-3","6.4.2-3+deb13u1","6.4.2-3+deb13u2","6.5.2-1","6.5.2-2","6.5.2-3","6.5.4-0.1","6.5.4-1","6.5.5-1","6.5.5-2","6.5.5-3","6.5.5-4","6.5.5-5","6.6.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.2-3","6.5.2-1","6.5.2-2","6.5.2-3","6.5.4-0.1","6.5.4-1","6.5.5-1","6.5.5-2","6.5.5-3","6.5.5-4","6.5.5-5","6.6.0-1"]},{"source":"osv","ecosystem":"PyPI","package":"tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6"}]}],"versions":["0.2","1.0","1.1","1.1.1","1.2","1.2.1","2.0","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","3.0","3.0.1","3.0.2","3.1","3.1.1","3.2","3.2.1","3.2.2","4.0","4.0.1","4.0.2","4.1","4.1b2","4.2","4.2.1","4.2b1","4.3","4.3b1","4.3b2","4.4","4.4.1","4.4.2","4.4.3","4.4b1","4.5","4.5.1","4.5.2","4.5.3","4.5b1","4.5b2","5.0","5.0.1","5.0.2","5.0a1","5.0b1","5.1","5.1.1","5.1b1","6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0a1","6.0b1","6.1","6.1b1","6.1b2","6.2","6.2b1","6.2b2","6.3","6.3.1","6.3.2","6.3.3","6.3b1","6.4","6.4.1","6.4.2","6.4b1","6.5","6.5.1","6.5.10","6.5.2","6.5.3","6.5.4","6.5.5","6.5.6","6.5.7","6.5.8","6.5.9","6.5b1","6.6a1","6.6b1","6.6rc1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6-1.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6-1.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6-1.oe2403sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.1-1ubuntu2","4.2.1-1ubuntu3","4.2.1-1ubuntu3.1","4.2.1-1ubuntu3.1+esm1","4.2.1-1ubuntu3.1+esm2","4.2.1-1ubuntu3.1+esm3","4.2.1-1ubuntu3.1+esm4","4.2.1-1ubuntu3.1+esm5","4.2.1-1ubuntu3.1+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.1-2.1~build2","4.5.2-1","4.5.3-1","4.5.3-1ubuntu0.1","4.5.3-1ubuntu0.2","4.5.3-1ubuntu0.2+esm1","4.5.3-1ubuntu0.2+esm2","4.5.3-1ubuntu0.2+esm3","4.5.3-1ubuntu0.2+esm4","4.5.3-1ubuntu0.2+esm5","4.5.3-1ubuntu0.2+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.1-4ubuntu1","5.1.1-4ubuntu5","6.0.3+really5.1.1-2","6.0.3+really5.1.1-2build1","6.0.3+really5.1.1-2build2","6.0.3+really5.1.1-3","6.0.3+really5.1.1-3ubuntu0.1~esm1","6.0.3+really5.1.1-3ubuntu0.1~esm3","6.0.3+really5.1.1-3ubuntu0.1~esm5","6.0.3+really5.1.1-3ubuntu0.1~esm7","6.0.3+really5.1.1-3ubuntu0.1~esm8","6.0.3+really5.1.1-3ubuntu0.1~esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1build1","6.1.0-2","6.1.0-3","6.1.0-3build1","6.1.0-3ubuntu0.1~esm1","6.1.0-3ubuntu0.1~esm2","6.1.0-3ubuntu0.1~esm4","6.1.0-3ubuntu0.1~esm5","6.1.0-3ubuntu0.1~esm6","6.1.0-3ubuntu0.1~esm7","6.1.0-3ubuntu0.1~esm8"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.3.2-1","6.4.0-0ubuntu1","6.4.0-1","6.4.0-1build1","6.4.0-1ubuntu0.1","6.4.0-1ubuntu0.2","6.4.0-1ubuntu0.4","6.4.0-1ubuntu0.5","6.4.0-1ubuntu0.6","6.4.0-1ubuntu0.7","6.4.0-1ubuntu0.8"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.4-0.1","6.5.5-2","6.5.5-4","6.5.5-5","6.5.5-5ubuntu1.1","6.5.5-5ubuntu1.2","6.5.5-5ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.2-3","6.5.2-3","6.5.4-0.1","6.5.4-0.1ubuntu0.1","6.5.4-0.1ubuntu0.2","6.5.4-0.1ubuntu0.3","6.5.4-0.1ubuntu0.4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-tornado6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6-1.1"}]}],"bundled":3}],"products":[{"vendor":"tornadoweb","product":"tornado"}],"references":[{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw9p-v7r6-gx4p","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/tornadoweb/tornado/pull/3786","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/tornadoweb/tornado/commit/940ea725bdd9bc68231d68a105eef17ea6e11233","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/tornadoweb/tornado/commit/cc75ab0eb3af459c714895a49f682ad354f50117","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/tornadoweb/tornado/commit/ccb6a2e5482f17997efd4a74b8200d5b4babc035","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/tornadoweb/tornado/releases/tag/v6.6.0","tags":["x_refsource_MISC","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116578","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-pw9p-v7r6-gx4p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116578.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-116578","tags":["advisory"]},{"url":"https://github.com/tornadoweb/tornado","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4798","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116577","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4799","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4800","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-116578","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116578","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-115927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116578","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-116578","title":"Tornado: Open redirect in RedirectHandler via protocol-relative URLs","description":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.","status":"published","published":"2026-10-26T20:22:32.217Z","modified":"2026-10-30T14:28:27.285Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:20:03.827373Z"}],"euvd":[{"id":"EUVD-2026-110319","description":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.","status":"published","published":"2026-10-26T20:22:32Z","modified":"2026-10-30T14:28:27Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low"}],"updated_at":"2026-11-02T16:59:06.607412Z"}],"ghsa":[{"id":"GHSA-pw9p-v7r6-gx4p","title":"Tornado: Open redirect in RedirectHandler via protocol-relative URLs","description":"### Summary\n\n`tornado.web.RedirectHandler` builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the application's domain, which can be used in phishing.\n\n### Impact\n\nApplications are affected if they use `RedirectHandler` with a URL template where a regex capture group can influence the scheme or host of the redirect. This includes:\n\n- **A substitution at the start of the path**, for example `(r\"/(.*)/target\", RedirectHandler, {\"url\": \"/{0}/destination\"})`. A request to `https://example.com//evil.com/target` redirects to `//evil.com/destination`, a protocol-relative URL pointing to evil.com. Variants using backslashes or encoded characters have the same effect, because browsers treat them as equivalent to `//`.\n- **A substitution directly after the host**, for example `(r\"/old(.*)\", RedirectHandler, {\"url\": \"https://new.example.com{0}\"})`. A request to `/old.evil.com/` or `/old@evil.com/` redirects to evil.com.\n- **A template that begins with a substitution** (such as `\"{0}\"`), which can be given an absolute URL.\n\nApplications are not affected if their `RedirectHandler` templates use only static URLs, or if every substitution comes after a fixed host and a `/` (for example `\"/static/{0}\"` or `\"https://example.com/{0}\"`). Other uses of `RequestHandler.redirect()` are not affected by this advisory, although applications that pass user-controlled input to `redirect()` should validate it themselves.\n\n### Patches\n\nFixed in Tornado 6.6. `RedirectHandler` now returns a 400 error if the substituted values would change the scheme or host of the redirect from what the template specifies. As a result, substitutions can no longer be used in the scheme or host part of a template. The similar check in `StaticFileHandler` has also been hardened against backslash and whitespace variants.\n\n### Workarounds\n\n- Change `RedirectHandler` templates so every substitution comes after a fixed prefix ending in `/`, or write capture-group regexes that cannot match characters such as `/`, `\\`, `@`, `.` or `:` where they could affect the host.\n- Alternatively, replace `RedirectHandler` with a custom handler that validates the target before calling `self.redirect()`.\n\n### Credit\n\nReported by Longwei Wang (@gn00295120).","status":"published","published":"2026-10-28T22:43:45Z","modified":"2026-10-28T22:43:46Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:41:39.926569Z"}],"nvd":[{"id":"CVE-2026-116578","description":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.","status":"published","published":"2026-10-26T21:18:14.747Z","modified":"2026-10-30T15:16:46.37Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:13:03.746397Z"}],"osv":[{"id":"CVE-2026-116578","title":"Tornado: Open redirect in RedirectHandler via protocol-relative URLs","description":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.","status":"published","published":"2026-10-26T20:22:32.217Z","modified":"2026-11-06T17:27:25.838175446Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low"}],"cwes":["CWE-601"],"updated_at":"2026-11-06T18:02:20.135715Z"},{"id":"DEBIAN-CVE-2026-116578","description":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.","status":"published","published":"2026-10-26T21:18:14.747Z","modified":"2026-10-31T10:01:07.184585348Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:45:50.923612Z"},{"id":"GHSA-pw9p-v7r6-gx4p","title":"Tornado: Open redirect in RedirectHandler via protocol-relative URLs","description":"### Summary\n\n`tornado.web.RedirectHandler` builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the application's domain, which can be used in phishing.\n\n### Impact\n\nApplications are affected if they use `RedirectHandler` with a URL template where a regex capture group can influence the scheme or host of the redirect. This includes:\n\n- **A substitution at the start of the path**, for example `(r\"/(.*)/target\", RedirectHandler, {\"url\": \"/{0}/destination\"})`. A request to `https://example.com//evil.com/target` redirects to `//evil.com/destination`, a protocol-relative URL pointing to evil.com. Variants using backslashes or encoded characters have the same effect, because browsers treat them as equivalent to `//`.\n- **A substitution directly after the host**, for example `(r\"/old(.*)\", RedirectHandler, {\"url\": \"https://new.example.com{0}\"})`. A request to `/old.evil.com/` or `/old@evil.com/` redirects to evil.com.\n- **A template that begins with a substitution** (such as `\"{0}\"`), which can be given an absolute URL.\n\nApplications are not affected if their `RedirectHandler` templates use only static URLs, or if every substitution comes after a fixed host and a `/` (for example `\"/static/{0}\"` or `\"https://example.com/{0}\"`). Other uses of `RequestHandler.redirect()` are not affected by this advisory, although applications that pass user-controlled input to `redirect()` should validate it themselves.\n\n### Patches\n\nFixed in Tornado 6.6. `RedirectHandler` now returns a 400 error if the substituted values would change the scheme or host of the redirect from what the template specifies. As a result, substitutions can no longer be used in the scheme or host part of a template. The similar check in `StaticFileHandler` has also been hardened against backslash and whitespace variants.\n\n### Workarounds\n\n- Change `RedirectHandler` templates so every substitution comes after a fixed prefix ending in `/`, or write capture-group regexes that cannot match characters such as `/`, `\\`, `@`, `.` or `:` where they could affect the host.\n- Alternatively, replace `RedirectHandler` with a custom handler that validates the target before calling `self.redirect()`.\n\n### Credit\n\nReported by Longwei Wang (@gn00295120).","status":"published","published":"2026-10-28T22:43:45Z","modified":"2026-10-28T23:00:04.066537287Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"OESA-2026-4798","title":"python-tornado security update","description":"Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived connection to each user.\r\n\r\nSecurity Fix(es):\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.(CVE-2026-115927)\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado\u0026apos;s HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.(CVE-2026-116577)\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application\u0026apos;s domain for phishing. This issue is fixed in version 6.6.(CVE-2026-116578)","status":"published","published":"2026-11-11T12:26:16Z","modified":"2026-11-11T12:45:07.500813004Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4799","title":"python-tornado security update","description":"Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived connection to each user.\r\n\r\nSecurity Fix(es):\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.(CVE-2026-115927)\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado\u0026apos;s HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.(CVE-2026-116577)\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application\u0026apos;s domain for phishing. This issue is fixed in version 6.6.(CVE-2026-116578)","status":"published","published":"2026-11-11T12:26:17Z","modified":"2026-11-11T12:45:07.504282553Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"OESA-2026-4800","title":"python-tornado security update","description":"Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. By using non-blocking network I/O, Tornado can scale to tens of thousands of open connections, making it ideal for long polling, WebSockets, and other applications that require a long-lived connection to each user.\r\n\r\nSecurity Fix(es):\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to monopolize the process event loop and stall every other connection served by that process, while lowering max_body_size only limits the duration of each request. For handlers that do not use @stream_request_body, retaining each chunk as a separate object can consume roughly twenty times the received body size, and SimpleAsyncHTTPClient has the same event-loop behavior when reading a response from a malicious server. This issue is fixed in version 6.6.0.(CVE-2026-115927)\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado\u0026apos;s HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block containing many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected. This issue is fixed in version 6.6.(CVE-2026-116577)\n\nTornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application\u0026apos;s domain for phishing. This issue is fixed in version 6.6.(CVE-2026-116578)","status":"published","published":"2026-11-11T12:26:17Z","modified":"2026-11-11T12:45:06.745550266Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"UBUNTU-CVE-2026-116578","description":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.","status":"published","published":"2026-10-26T21:18:00Z","modified":"2026-11-12T17:25:21.320177628Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"low"}],"updated_at":"2026-11-12T18:05:20.578263Z"},{"id":"AZL-111736","title":"CVE-2026-116578 affecting package python-tornado 6.3.3-11","description":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.","status":"published","published":"2026-10-26T21:18:14Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"CLSA-2026-1793872514","title":"TuxCare security update for tornado (3 CVEs)","description":"TuxCare rebuilt tornado to address 3 CVEs. Fixed in 6.1.0.post11+tuxcare.","status":"published","published":"2026-11-05T10:55:15Z","modified":"2026-11-05T13:15:16.678127586Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1794218750","title":"TuxCare security update for tornado (3 CVEs)","description":"TuxCare rebuilt tornado to address 3 CVEs. Fixed in 5.1.1.post7+tuxcare.","status":"published","published":"2026-11-09T11:05:51Z","modified":"2026-11-09T19:15:14.554614128Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"openSUSE-SU-2026:12440-1","title":"python313-tornado6-6.6-1.1 on GA media","description":"These are all security issues fixed in the python313-tornado6-6.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-05T00:00:00Z","modified":"2026-11-06T17:23:10.698741151Z","updated_at":"2026-11-06T18:05:03.243497Z"}]}}