Red Hat Product Security issued an advisory (RHSA-2026:20577) for python-tornado in Red Hat Enterprise Linux 10.0 Extended Update Support addressing two vulnerabilities: CVE-2026-31958, a denial of service vulnerability triggered by large multipart bodies, and CVE-2026-35536, a cookie attribute injection vulnerability caused by improper handling of cookie arguments. The advisory provides updated package versions for multiple architectures including x86_64, s390x, ppc64le, and aarch64. The vulnerabilities are rated with moderate security impact and no CVSS scores are provided. The advisory includes instructions and links for applying the updates. No known exploitation has been reported.

The vulnerabilities could allow an attacker to cause a denial of service condition by sending large multipart bodies to the Tornado server (CVE-2026-31958) and to inject cookie attributes improperly due to flawed cookie argument handling (CVE-2026-35536). These issues may affect the stability and security of applications using the affected python-tornado versions. Red Hat rates the overall impact as moderate. There are no reports of active exploitation in the wild.

Red Hat has released updated python-tornado packages for Red Hat Enterprise Linux 10.0 Extended Update Support that address these vulnerabilities. Users should apply these official updates as described in the Red Hat advisory RHSA-2026:20577 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor. Patch status is confirmed as official-fix via the vendor advisory.