Bug 2500661 (CVE-2026-49854)

Summary: CVE-2026-49854 tornado: Tornado: Information disclosure via out-of-bounds read in websocket_mask
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anpicker, bbrownin, dschmidt, ebourniv, hasun, jfula, jlanda, jowilson, jwong, kaycoth, kshier, lgallett, nyancey, omaciel, ometelka, ptisnovs, rhel-process-autobot, rjohnson, sbunciak, simaishi, stcannon, syedriko, teagle, ttakamiy, watson-tool-maintainers, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Tornado, a Python web framework. The optional native extension `tornado.speedups` did not properly validate the `mask` argument in its `websocket_mask` function. This allowed the C function to read beyond the intended buffer, potentially exposing up to three bytes of uninitialized memory. This vulnerability can be triggered when the native extension is active and Tornado's Cross-Site Request Forgery (XSRF) token decoder is in use, leading to information disclosure.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2501082, 2501083, 2501084, 2501085, 2501086, 2501087, 2501088, 2501089, 2501090, 2501091    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-14 21:03:36 UTC 
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6.