Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Python Tornado: Authorization and Memory Risks
published 4 months ago
Summary
This update fixes security risks in Python Tornado that could allow unauthorized access to your website or system. It also prevents potential crashes and data corruption. We recommend installing this update to ensure the security of your Python Tornado application.
What to do
- Update suse python-tornado to version 4.5.3-150000.3.22.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | suse | python-tornado |
< 4.5.3-150000.3.22.1 Fix: upgrade to 4.5.3-150000.3.22.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | suse | python-tornado |
< 4.5.3-150000.3.22.1 Fix: upgrade to 4.5.3-150000.3.22.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | suse | python-tornado |
< 4.5.3-150000.3.22.1 Fix: upgrade to 4.5.3-150000.3.22.1
|
| SUSE:Linux Enterprise Micro 5.3 | suse | python-tornado |
< 4.5.3-150000.3.22.1 Fix: upgrade to 4.5.3-150000.3.22.1
|
| SUSE:Linux Enterprise Micro 5.4 | suse | python-tornado |
< 4.5.3-150000.3.22.1 Fix: upgrade to 4.5.3-150000.3.22.1
|
| SUSE:Linux Enterprise Micro 5.5 | suse | python-tornado |
< 4.5.3-150000.3.22.1 Fix: upgrade to 4.5.3-150000.3.22.1
|
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | suse | python-tornado |
< 4.5.3-150000.3.22.1 Fix: upgrade to 4.5.3-150000.3.22.1
|
| SUSE:Linux Enterprise Server 15 SP4-LTSS | suse | python-tornado |
< 4.5.3-150000.3.22.1 Fix: upgrade to 4.5.3-150000.3.22.1
|
| SUSE:Linux Enterprise Server 15 SP5-LTSS | suse | python-tornado |
< 4.5.3-150000.3.22.1 Fix: upgrade to 4.5.3-150000.3.22.1
|
| SUSE:Linux Enterprise Server 15 SP6-LTSS | suse | python-tornado |
< 4.5.3-150000.3.22.1 Fix: upgrade to 4.5.3-150000.3.22.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | suse | python-tornado |
< 4.5.3-150000.3.22.1 Fix: upgrade to 4.5.3-150000.3.22.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | suse | python-tornado |
< 4.5.3-150000.3.22.1 Fix: upgrade to 4.5.3-150000.3.22.1
|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | suse | python-tornado |
< 4.5.3-150000.3.22.1 Fix: upgrade to 4.5.3-150000.3.22.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | suse | python-tornado |
< 4.5.3-150000.3.22.1 Fix: upgrade to 4.5.3-150000.3.22.1
|
Original advisory text
Security update for python-tornado
This update for python-tornado fixes the following issues
- CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395).
- CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
- CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).
- CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395).
- CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396).
- CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (bsc#1268397).
References
- https://www.suse.com/support/update/announcement/2026/suse-su-20262726-1/ Vendor Advisory
- https://bugzilla.suse.com/1268395 Third Party Advisory
- https://bugzilla.suse.com/1268396 Third Party Advisory
- https://bugzilla.suse.com/1268397 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-49853 URL
- https://www.suse.com/security/cve/CVE-2026-49854 URL
- https://www.suse.com/security/cve/CVE-2026-49855 URL
Timeline
Published2 Jul 2026
Updated3 Jul 2026
First seen3 Jul 2026
Sources
SUSE-SU-2026:2726-1 · OSV
Track software like this
Free during beta