CVE-2026-49854: Tornado: Out-of-bounds memory access in C extension
Summary
Tornado's optional native extension tornado.speedups implements websocketmask without validating that the mask argument is exactly four bytes long. The C function reads four bytes from mask unconditionally, even when Python passes a shorter byte string. This can read beyond the provided buffer, exposing up to 3 bytes of uninitialized memory.
The behavior is reachable from Tornado's XSRF token decoder when xsrfcookies=True and the native extension is active.
Mitigations
This bug is fixed in Tornado 6.5.6. Prior to upgrading to this version, setting the environment variable TORNADOEXTENSION=0 will disable the vulnerable code (at the expense of reducing websocket performance).
Other sources
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocketmask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/tornadoto a version that resolves this vulnerability.Fixed in 6.5.6 - Upgrade
Upgrade
tornadoto a version that resolves this vulnerability.Fixed in 6.5.6 - Configuration
Set environment variable TORNADO_EXTENSION=0 to disable the vulnerable native extension code prior to upgrading (xsrf_cookies=True will then avoid the native extension path, at the expense of reducing websocket performance).
Tornado native extension tornado.speedups TORNADO_EXTENSION = 0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49854?
The severity of CVE-2026-49854 is low with a score of 3.7.
How do I fix CVE-2026-49854?
To fix CVE-2026-49854, update to the latest version of Tornado that addresses the vulnerability.
What risks does CVE-2026-49854 pose?
CVE-2026-49854 poses a risk of potential memory corruption due to improper handling of the mask argument in the WebSocket implementation.
Which versions of Tornado are affected by CVE-2026-49854?
CVE-2026-49854 affects versions prior to the fix included in Tornado version 6.5.6.
Is user interaction required to exploit CVE-2026-49854?
No, user interaction is not required to exploit CVE-2026-49854.