Threats tagged 'ghsa-5cjw-f85j-cv6r'

Tornado versions prior to 6.6.1 contain an open redirect vulnerability due to inconsistent URL parsing between browsers and Python's urllib. This discrepancy allows URLs starting with three or more slashes to bypass the redirect protections fixed in version 6.6.0. The issue is addressed in Tornado 6.6.1, which improves detection and fixes a regression from the previous fix.