Red Hat Security Advisory: python-tornado security update
Two security vulnerabilities affecting the python-tornado package in Red Hat Enterprise Linux 10 have been addressed. CVE-2026-31958 is a denial of service vulnerability triggered by large multipart bodies. CVE-2026-35536 involves cookie attribute injection due to improper handling of cookie arguments. Red Hat has released an updated python-tornado package version 6. 5. 5-1. el10_1. 1 that fixes these issues. The update is rated as having a moderate security impact. No known exploits are reported in the wild at this time.
AI Analysis
Technical Summary
The Red Hat python-tornado package for Red Hat Enterprise Linux 10 contains two vulnerabilities: CVE-2026-31958, a denial of service via large multipart bodies, and CVE-2026-35536, a cookie attribute injection vulnerability caused by improper handling of cookie arguments. These issues are addressed in the updated package python-tornado-6.5.5-1.el10_1.1. The advisory references CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-88 (Argument Injection or Modification). No CVSS scores are provided in the advisory, but Red Hat rates the impact as moderate.
Potential Impact
Successful exploitation of CVE-2026-31958 could allow an attacker to cause a denial of service by sending large multipart bodies to the Tornado server. CVE-2026-35536 could allow injection of cookie attributes, potentially affecting cookie handling security. The advisory does not report any known exploits in the wild. The overall security impact is rated moderate by Red Hat.
Mitigation Recommendations
Red Hat has released an updated python-tornado package version 6.5.5-1.el10_1.1 that fixes these vulnerabilities. Users of affected Red Hat Enterprise Linux 10 versions should apply this update promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation actions are specified or required beyond applying the official update.
Red Hat Security Advisory: python-tornado security update
Description
Two security vulnerabilities affecting the python-tornado package in Red Hat Enterprise Linux 10 have been addressed. CVE-2026-31958 is a denial of service vulnerability triggered by large multipart bodies. CVE-2026-35536 involves cookie attribute injection due to improper handling of cookie arguments. Red Hat has released an updated python-tornado package version 6. 5. 5-1. el10_1. 1 that fixes these issues. The update is rated as having a moderate security impact. No known exploits are reported in the wild at this time.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Red Hat python-tornado package for Red Hat Enterprise Linux 10 contains two vulnerabilities: CVE-2026-31958, a denial of service via large multipart bodies, and CVE-2026-35536, a cookie attribute injection vulnerability caused by improper handling of cookie arguments. These issues are addressed in the updated package python-tornado-6.5.5-1.el10_1.1. The advisory references CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-88 (Argument Injection or Modification). No CVSS scores are provided in the advisory, but Red Hat rates the impact as moderate.
Potential Impact
Successful exploitation of CVE-2026-31958 could allow an attacker to cause a denial of service by sending large multipart bodies to the Tornado server. CVE-2026-35536 could allow injection of cookie attributes, potentially affecting cookie handling security. The advisory does not report any known exploits in the wild. The overall security impact is rated moderate by Red Hat.
Mitigation Recommendations
Red Hat has released an updated python-tornado package version 6.5.5-1.el10_1.1 that fixes these vulnerabilities. Users of affected Red Hat Enterprise Linux 10 versions should apply this update promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation actions are specified or required beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:13641
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-35536"]
- Cvss Version
- null
Threat ID: 6a160977e29bf47b5064321f
Added to database: 5/26/2026, 8:58:31 PM
Last enriched: 5/26/2026, 11:35:35 PM
Last updated: 5/27/2026, 4:54:42 AM
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.