Threats tagged 'brew-jupyterlab-cve-2026-49854'

A vulnerability in Tornado's native extension used by JupyterLab allows out-of-bounds memory access due to improper validation of the mask argument length in the websocket_mask function. This flaw can expose up to 3 bytes of uninitialized memory. The issue occurs when Tornado's XSRF token decoder is used with xsrf_cookies enabled and the native extension active. The vulnerability is fixed in Tornado version 4.5.8.