CVE-2026-49854
python-tornado: This update for python-tornado fixes the following issues - CVE-2026-49853: authorization header forwarded across cr...
CVE-2026-49854 is fixed in 10 products on 1 platform, first by OPENSUSE-SU-2026:21067-1, released June 26, 2026. It is not reported as exploited. Patch Radar priority: High.
High
CVSS
n/a
important
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0042
36th percentile
This update for python-tornado fixes the following issues - CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395). - CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396). - CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| python-tornado · sles 15.6 | 4.5.3-150000.3.22.1 | SUSE-SU-2026:2726-1 | Jul 2, 2026 |
| python-tornado · sles 15.7 | 4.5.3-150000.3.22.1 | SUSE-SU-2026:2726-1 | Jul 2, 2026 |
| python-tornado-debugsource · amzn 2023 | 6.1.0-2.amzn2023.0.9 | ALAS2023-2026-2016 | Aug 3, 2026 |
| python-tornado-doc · amzn 2023 | 6.1.0-2.amzn2023.0.9 | ALAS2023-2026-2016 | Aug 3, 2026 |
| python-tornado6 · opensuse-leap 16.0 | 6.5-160000.5.1 | OPENSUSE-SU-2026:21067-1 | Jun 26, 2026 |
| python-tornado6 · sles 15.6 | 6.3.2-150400.9.18.1 | SUSE-SU-2026:2725-1 | Jul 2, 2026 |
| python-tornado6 · sles 15.7 | 6.3.2-150400.9.18.1 | SUSE-SU-2026:2725-1 | Jul 2, 2026 |
| python-tornado6 · sles 16.0 | 6.5-160000.5.1 | SUSE-SU-2026:22373-1 | Jun 26, 2026 |
| python3-tornado · amzn 2023 | 6.1.0-2.amzn2023.0.9 | ALAS2023-2026-2016 | Aug 3, 2026 |
| python3-tornado-debuginfo · amzn 2023 | 6.1.0-2.amzn2023.0.9 | ALAS2023-2026-2016 | Aug 3, 2026 |
| python3.13-tornado · amzn 2023 | 6.4.2-1.amzn2023.0.4 | ALAS2023-2026-2015 | Aug 3, 2026 |
| python3.13-tornado-debuginfo · amzn 2023 | 6.4.2-1.amzn2023.0.4 | ALAS2023-2026-2015 | Aug 3, 2026 |
| python3.13-tornado-debugsource · amzn 2023 | 6.4.2-1.amzn2023.0.4 | ALAS2023-2026-2015 | Aug 3, 2026 |
| python3.13-tornado-doc · amzn 2023 | 6.4.2-1.amzn2023.0.4 | ALAS2023-2026-2015 | Aug 3, 2026 |