---
id: CVE-2026-49854
aliases:
  - GHSA-cx3h-4qpv-8hc9
  - PYSEC-2026-3388
title: Tornado has out-of-bounds memory access via C extension
summary: Tornado has out-of-bounds memory access via C extension
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
vendor: tornado
product: tornado
ecosystem: pip
affected:
  - tornado < 6.5.6
patched:
  - tornado 6.5.6
published: '2026-06-12'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:49.232529305Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-cx3h-4qpv-8hc9'
references:
  - url: >-
      https://github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9
  - url: 'https://github.com/tornadoweb/tornado'
  - url: 'https://github.com/tornadoweb/tornado/releases/tag/v6.5.6'
  - url: 'https://github.com/advisories/GHSA-cx3h-4qpv-8hc9'
tags:
  - osv
  - pip
  - ghsa
epss: 0.00419
epssPercentile: 0.33596
cwe:
  - CWE-126
ingestedAt: '2026-07-07T15:41:59.216Z'
---

## Overview

### Summary

Tornado's optional native extension `tornado.speedups` implements `websocket_mask` without validating that the `mask` argument is exactly four bytes long. The C function reads four bytes from `mask` unconditionally, even when Python passes a shorter byte string. This can read beyond the provided buffer, exposing up to 3 bytes of uninitialized memory.

The behavior is reachable from Tornado's XSRF token decoder when `xsrf_cookies=True` and the native extension is active. 

### Mitigations

This bug is fixed in Tornado 6.5.6. Prior to upgrading to this version, setting the environment variable TORNADO_EXTENSION=0 will disable the vulnerable code (at the expense of reducing websocket performance).

## Affected packages

- `tornado < 6.5.6`

## Remediation

Upgrade to a patched release:

- `tornado 6.5.6`