{"id":"CVE-2026-49854","aliases":["GHSA-cx3h-4qpv-8hc9","PYSEC-2026-3388"],"title":"Tornado has out-of-bounds memory access via C extension","summary":"Tornado has out-of-bounds memory access via C extension","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","vendor":"tornado","product":"tornado","ecosystem":"pip","affected":["tornado < 6.5.6"],"patched":["tornado 6.5.6"],"published":"2026-06-12","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:49.232529305Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-cx3h-4qpv-8hc9","references":[{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9"},{"url":"https://github.com/tornadoweb/tornado"},{"url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.6"},{"url":"https://github.com/advisories/GHSA-cx3h-4qpv-8hc9"}],"tags":["osv","pip","ghsa"],"epss":0.00419,"epssPercentile":0.33498,"cwe":["CWE-126"],"ingestedAt":"2026-07-07T15:41:59.216Z","slug":"CVE-2026-49854","body":"## Overview\n\n### Summary\n\nTornado's optional native extension `tornado.speedups` implements `websocket_mask` without validating that the `mask` argument is exactly four bytes long. The C function reads four bytes from `mask` unconditionally, even when Python passes a shorter byte string. This can read beyond the provided buffer, exposing up to 3 bytes of uninitialized memory.\n\nThe behavior is reachable from Tornado's XSRF token decoder when `xsrf_cookies=True` and the native extension is active. \n\n### Mitigations\n\nThis bug is fixed in Tornado 6.5.6. Prior to upgrading to this version, setting the environment variable TORNADO_EXTENSION=0 will disable the vulnerable code (at the expense of reducing websocket performance).\n\n## Affected packages\n\n- `tornado < 6.5.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `tornado 6.5.6`","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}