CVE catalog
CVE-2026-116578
python-tornado: CVE-2026-116578
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | python-tornado | sid | 6.5.5-5 | vulnerable |
| Debian | python-tornado | forky | 6.5.5-5 | vulnerable |
| Debian | python-tornado | trixie | 6.4.2-3+deb13u2 | vulnerable |
| Debian | python-tornado | trixie-security | 6.4.2-3+deb13u2 | vulnerable |
| Debian | python-tornado | bookworm | 6.2.0-3+deb12u4 | vulnerable |
| Debian | python-tornado | bookworm-security | 6.2.0-3+deb12u4 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | python-tornado | source | sid | (unfixed) | not yet assigned | Not reported | [1152300] |
| Debian | python-tornado | source | forky | (unfixed) | not yet assigned | Not reported | [1152300] |
| Debian | python-tornado | source | trixie | (unfixed) | not yet assigned | Not reported | [1152300] |
| Debian | python-tornado | source | bookworm | (unfixed) | not yet assigned | Not reported | [1152300] |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [python3-tornado]Affected
Source package: [python-tornado]
Details (4)
6.2.0-3+deb12u4· amd64 · bookwormAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· arm64 · bookwormAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· amd64 · bookworm-securityAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· arm64 · bookworm-securityAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
- [python-tornado-doc]Affected
Source package: [python-tornado]
Details (4)
6.2.0-3+deb12u4· all · bookwormAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· all · bookwormAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· all · bookworm-securityAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
6.2.0-3+deb12u4· all · bookworm-securityAffected
dsa · python-tornado · debian · bookworm; dsa · python-tornado · debian · 12
[Debian 13 (Trixie)]
- [python3-tornado]Affected
Source package: [python-tornado]
Details (4)
6.4.2-3+deb13u2· amd64 · trixieAffected
dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· arm64 · trixieAffected
dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· amd64 · trixie-securityAffected
dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· arm64 · trixie-securityAffected
dsa · python-tornado · debian · 13
- [python-tornado-doc]Affected
Source package: [python-tornado]
Details (4)
6.4.2-3+deb13u2· all · trixieAffected
dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· all · trixieAffected
dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· all · trixie-securityAffected
dsa · python-tornado · debian · 13
6.4.2-3+deb13u2· all · trixie-securityAffected
dsa · python-tornado · debian · 13
Observed: