A regression was introduced in the Tornado web server due to an incomplete fix for CVE-2026-103263, which broke static file serving for applications subclassing Tornado's StaticFileHandler, such as Jupyter. The original vulnerability involved improper handling of certain HTTP requests and network inputs, potentially allowing denial of service, information exposure, or access control bypass. This regression has been fixed in updated Tornado package versions.