USN-8952-1: Tornado vulnerabilities
Published Oct 22, 2026
·Updated
It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls. (CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262, CVE-2026-103263)
Affected Software
15 affected componentsFixes available
ubuntu/tornado
All of the following
ubuntu/python3-tornado<6.5.5-5ubuntu1.1
6.5.5-5ubuntu1.1
Ubuntu Ubuntu=26.10
All of the following
ubuntu/python3-tornado<6.5.4-0.1ubuntu0.2
6.5.4-0.1ubuntu0.2
Ubuntu Ubuntu=26.04
All of the following
ubuntu/python3-tornado<6.4.0-1ubuntu0.6
6.4.0-1ubuntu0.6
Ubuntu Ubuntu=24.04
All of the following
ubuntu/python3-tornado<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=22.04
All of the following
ubuntu/python3-tornado<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=20.04
All of the following
ubuntu/python3-tornado<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=18.04
All of the following
ubuntu/python3-tornado<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=16.04
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/python3-tornadoto a version that resolves this vulnerability.Fixed in 6.5.5-5ubuntu1.1 - Upgrade
Upgrade
ubuntu/python3-tornadoto a version that resolves this vulnerability.Fixed in 6.5.4-0.1ubuntu0.2 - Upgrade
Upgrade
ubuntu/python3-tornadoto a version that resolves this vulnerability.Fixed in 6.4.0-1ubuntu0.6 - Upgrade
Upgrade
ubuntu/python3-tornadoto a version that resolves this vulnerability.Fixed in Ubuntu Pro
Event History
Oct 22, 2026
Advisory Published
via Ubuntu·12:00 AM
Data Sourced
via Ubuntu·12:00 AM
DescriptionAffected Software
Child vulnerabilities
Contains the following vulnerabilities.