Skip to main content
CVE-2026-49853VulnerabilityPublished Updated

Red Hat Security Advisory: python-tornado security update

Affects Red Hat python-tornadoSource GCVE Database

0
Compare

Mentioned vulnerabilities

Not known to be exploited.

Data as of 29 Oct 2026, 07:43 UTC

Severity
High

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS
0.4% chance of exploitation in 30 days – higher than 38% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 26 Oct 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.

What to do

AI-suggested

Red Hat has released updated python-tornado packages for Red Hat Enterprise Linux 9.6 Extended Update Support that address these vulnerabilities. Users should apply the provided security updates as detailed in the Red Hat advisory RHSA-2026:90283 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patches.

Description

Multiple security vulnerabilities have been identified in the python-tornado package used in Red Hat Enterprise Linux 9.6 Extended Update Support. These include an information disclosure issue due to improper handling of credentials during HTTP redirects and several denial of service (DoS) vulnerabilities caused by uncontrolled gzip decompression memory consumption, memory amplification in multipart parsing, and decompression bomb attacks in CurlAsyncHTTPClient. Red Hat has issued an important security advisory with updates addressing these issues.

References

Community reviews

Loading reviews…