USN-8952-2: python-tornado regression

Q: Which deployments are most likely to encounter the regression?

Applications that subclass Tornado's StaticFileHandler are affected by the static-file-serving regression introduced by the incomplete fix. Jupyter is specifically identified as an example.

Q: What should teams do if they installed the earlier update?

Apply this follow-up update, which corrects the incomplete fix for CVE-2026-103263 and restores static file serving for affected subclasses.

Published Nov 6, 2026

Updated

USN-8952-1 fixed vulnerabilities in Tornado. Unfortunately that update was incomplete due to an incomplete fix for CVE-2026-103263, which broke static file serving for applications that subclass Tornado's StaticFileHandler, such as Jupyter, and could introduce a regression. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls.

(CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262, CVE-2026-103263)

Affected Software

7 affected componentsFixes available

ubuntu/python-tornado<4.2.1-1ubuntu3.1+esm5

4.2.1-1ubuntu3.1+esm5

ubuntu/python-tornado<4.5.3-1ubuntu0.2+esm5

4.5.3-1ubuntu0.2+esm5

ubuntu/python-tornado<6.0.3+really5.1.1-3ubuntu0.1~esm8

6.0.3+really5.1.1-3ubuntu0.1~esm8

ubuntu/python-tornado<6.1.0-3ubuntu0.1~esm7

6.1.0-3ubuntu0.1~esm7

ubuntu/python-tornado<6.4.0-1ubuntu0.7

6.4.0-1ubuntu0.7

ubuntu/python-tornado<6.5.5-5ubuntu1.2

6.5.5-5ubuntu1.2

ubuntu/python-tornado<6.5.4-0.1ubuntu0.3

6.5.4-0.1ubuntu0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/python-tornado to a version that resolves this vulnerability.
Fixed in 4.2.1-1ubuntu3.1+esm5
Upgrade
Upgrade ubuntu/python-tornado to a version that resolves this vulnerability.
Fixed in 4.5.3-1ubuntu0.2+esm5
Upgrade
Upgrade ubuntu/python-tornado to a version that resolves this vulnerability.
Fixed in 6.0.3+really5.1.1-3ubuntu0.1~esm8
Upgrade
Upgrade ubuntu/python-tornado to a version that resolves this vulnerability.
Fixed in 6.1.0-3ubuntu0.1~esm7
Upgrade
Upgrade ubuntu/python-tornado to a version that resolves this vulnerability.
Fixed in 6.4.0-1ubuntu0.7
Upgrade
Upgrade ubuntu/python-tornado to a version that resolves this vulnerability.
Fixed in 6.5.5-5ubuntu1.2
Upgrade
Upgrade ubuntu/python-tornado to a version that resolves this vulnerability.
Fixed in 6.5.4-0.1ubuntu0.3

Event History

Nov 6, 2026

Advisory Published

via OSV·03:04 PM

Data Sourced

via OSV·03:04 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which deployments are most likely to encounter the regression?

Applications that subclass Tornado's StaticFileHandler are affected by the static-file-serving regression introduced by the incomplete fix. Jupyter is specifically identified as an example.

What should teams do if they installed the earlier update?

Apply this follow-up update, which corrects the incomplete fix for CVE-2026-103263 and restores static file serving for affected subclasses.

USN-8952-2: python-tornado regression

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are most likely to encounter the regression?

What should teams do if they installed the earlier update?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most likely to encounter the regression?

What should teams do if they installed the earlier update?