SEPTEMBER 11, 2026
Live Feed
Back to database
Case File

CVE-2026-49854

MEDIUM · CVSS 5.3 EPSS 0.34% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-14 · Last synced 2026-08-13

CyberRota Analysis

AI-Generated

The Tornado web framework's native extension, tornado.speedups, is vulnerable due to improper validation of the mask argument in the websocket_mask function, potentially allowing buffer over-read. This can lead to unauthorized memory access, which may compromise application integrity and security. Developers and organizations using Tornado versions prior to 6.5.6 should prioritize upgrading to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-49854
Severity
MEDIUM
CVSS
5.3
EPSS
0.34%

Original NVD Description

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.