CVE-2026-126347

Deferred Deferred - Pending Action

Open Redirect in Tornado Web Framework

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: GitHub, Inc.

Description

Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications using tornado.web.RedirectHandler with URL templates that allow attacker-controlled substitutions to influence the destination can be vulnerable to an open redirect using three or more leading slashes. Differences between Python’s URL parsing and browser URL interpretation allow a crafted destination to redirect a user to an attacker-controlled host. The remediation for CVE-2026-116578 in version 6.6.0 did not fully address this case. This issue is fixed in version 6.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-12

Last Modified

2026-11-12

Generated

2026-11-13

AI Q&A

2026-11-13

EPSS Evaluated

N/A

NVD

CVE-2026-126347

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Tornado Python web framework. It involves applications using tornado.web.RedirectHandler with URL templates that allow attacker-controlled substitutions to influence the destination. Attackers can exploit this to perform an open redirect by using three or more leading slashes in the URL, which browsers interpret differently than Python's URL parsing.

Impact Analysis

This vulnerability could allow attackers to redirect users to malicious websites. Users might unknowingly visit harmful sites, leading to phishing attacks, malware downloads, or other security threats. The impact is limited as it requires user interaction and specific conditions.

Mitigation Strategies

Upgrade Tornado to version 6.6.1 or later to address the vulnerability. Review applications using tornado.web.RedirectHandler with URL templates to ensure attacker-controlled substitutions cannot influence the destination.

Hi! I’m here to help you understand CVE-2026-126347. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...