CVE-2026-49854

Deferred Deferred - Pending Action

Buffer Overflow in Tornado Web Framework

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-49854

Affected Vendors & Products

Vendor	Product	Version / Range
twisted	tornado	6.5.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-126	The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Attack-Flow Graph

Executive Summary

Tornado before 6.5.6 has a flaw in its optional native extension tornado.speedups where the websocket_mask function does not check if the mask argument is exactly four bytes long. This allows reading up to three extra bytes beyond the intended buffer when accessed through Tornado's XSRF token decoding with the native extension enabled.

Detection Guidance

To detect this vulnerability, check if your Tornado version is below 6.5.6. Run: python -c "import tornado; print(tornado.version)". If the output is less than 6.5.6, the system is vulnerable.

Impact Analysis

This vulnerability could allow an attacker to read sensitive memory data, potentially exposing confidential information if the native extension is active and the XSRF token decoding path is used.

Compliance Impact

The vulnerability involves a buffer overflow in Tornado's websocket_mask function, which could lead to memory corruption or information disclosure. This may impact compliance with GDPR (data protection) and HIPAA (health data security) by potentially exposing sensitive data if exploited.

Mitigation Strategies

Upgrade Tornado to version 6.5.6 or later to address the buffer overflow issue in the native extension tornado.speedups.

Hi! I’m here to help you understand CVE-2026-49854. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70