{"id":"CVE-2026-49854","summary":"Tornado: Out-of-bounds memory access in C extension","details":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.","aliases":["GHSA-cx3h-4qpv-8hc9","PYSEC-2026-3388"],"modified":"2026-08-12T16:09:42.426605Z","published":"2026-07-14T20:43:03.977Z","related":["CGA-gxmj-xx3h-94hw","SUSE-SU-2026:22286-1","SUSE-SU-2026:22373-1","SUSE-SU-2026:22430-1","SUSE-SU-2026:22445-1","SUSE-SU-2026:2725-1","SUSE-SU-2026:2726-1","SUSE-SU-2026:3291-1","openSUSE-SU-2026:11027-1","openSUSE-SU-2026:21067-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49854.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-126"]},"references":[{"type":"WEB","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49854.json"},{"type":"ADVISORY","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49854"},{"type":"FIX","url":"https://github.com/tornadoweb/tornado/commit/96dc88c2a05705287856b2cd6b4b4034f9a6aaac"},{"type":"FIX","url":"https://github.com/tornadoweb/tornado/pull/3626"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tornadoweb/tornado","events":[{"introduced":"0"},{"fixed":"96dc88c2a05705287856b2cd6b4b4034f9a6aaac"},{"fixed":"aba2569f7ed7a6bdbef816658fb6b7182531b751"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"6.5.6"}]}}],"versions":["v6.5.5","v6.5.4","v6.5.3","v6.5.2","v6.5.1","v6.5.0","v6.5.0b1","v6.4.1","v6.4.0","v6.4.0b1","v6.3.1","v6.3.0","v6.3.0b1","v6.2.0","v6.2.0b2","v6.2.0b1","v6.1.0","v6.1.0b2","v6.1.0b1","v6.0.0","v6.0.0b1","v5.1.0","v5.0.0","v4.5.0","v4.5.1","v4.4.1","v4.4.0","v4.4.0b1","v4.3.0","v4.3.0b2","v4.3.0b1","v4.2.0","v4.2.0b1","v4.1.0","v4.1.0b2","v4.1.0b1","v4.0.0","v4.0.0b3","v4.0.0b2","v4.0.0b1","v3.2.0","v3.2.0b2","v3.2.0b1","v3.1.0","v3.0.1","v3.0.0","v2.1.1","v2.3.0","v2.2.0","v2.1.0","v2.0.0","v1.2.0","v1.1.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49854.json","vanir_signatures_modified":"2026-08-12T16:09:42Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/tornadoweb/tornado/commit/96dc88c2a05705287856b2cd6b4b4034f9a6aaac","target":{"file":"tornado/speedups.c"},"deprecated":false,"digest":{"line_hashes":["69152222405742774919419822103616556764","136855752769639111195829491552343707515","134347400310488647173644052578299431655","210177054561993402163448072370861998577","150939033318264099469803118498694840174","44978230418197210418665842375245754147","323146380916282484097659453254075638852","307980670742470197743589870197436305892","124178985234500210554954807861892481501","298806864955955245326434189918260987010","302903515213188644053282803837467549708","101969162367672096027900378735187729983","256314579132342879389861526417842574747","291794480282353333693226023903022155497","121449369112449939788047203619823141368","249700224388221785793076185166567228666","87384731639233814664436377488334525344","153839714621802045139657011135592662135","310804282497436997995225171678919195455","75272632965016608641446228541415758475","153681437051003746646398433615045494797","175905540179349918679794070005052282435","26968051157052855385335253704642673240","43711998099368376768314740067028468356","317662269419033308372569101368678457740","286658246623988026070709271309776679120","150548722638703707528716594560945333841","1796113314753932800691218463121619100","114807482589785217419374889353565149788","265015882673733507258110704015923534775","143034310535923429762763424054448685063","329305966719808210187811916370459179288","2897493504112618498718845741387139714","286078512213557452790427043508039360626","241789140306854742961454188452461710875","83441191614807536354689381197301512841","262059835998961676086911433830457575535","301133630298617312456199687547688286995","202085559153190256010867507969852365102","103135069332671213204885403905257683662","42982089545384229737797148334791743045","242863890653840196196030300438076485979","191286845038798908907065235764230815026","103251180635809783272191462470945276027","145925226955266485012272184808482627454","5985586403280676399624459985428720851","235699647439434053363965129957896659818","230020978182409958660444302416723557390","50325927934901271970516351223829453365","271158877314015673402855397346009593868","150671140698853918069250513902903087402","78280349141596891715924072316370580218","302717973380483517858287986196285838838","329305182001377608841970185918840467507","257369295453954457772649606882959932997","113301957106642542394098911236068220558","121712917957453000368177804460479714676","68838777183800431608144784894308796609","300840310654846792023005765068706428558","74984595877538455641216885140514177482","139892350477176823751267183410527009807","280393001903846769411574858331483106241","89857992124729527477499615960622545768"],"threshold":0.9},"id":"CVE-2026-49854-6b66e329","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"282508762915572268356710576646415704649","length":804},"id":"CVE-2026-49854-b745e279","signature_type":"Function","signature_version":"v1","source":"https://github.com/tornadoweb/tornado/commit/96dc88c2a05705287856b2cd6b4b4034f9a6aaac","target":{"function":"websocket_mask","file":"tornado/speedups.c"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}