Bug 2568744 (CVE-2026-123534)

Summary: CVE-2026-123534 tornado: tornado: Denial of Service via path traversal in static_url
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, anpicker, aos-team-art-private, asdas, bbrownin, dpaolell, ebourniv, eglynn, hasun, jdelft, jfula, jjoyce, jlanda, jowilson, jpretori, jschluet, jupierce, jwong, kshier, lgarciaa, lhh, mbiarnes, mburns, mgarciac, nyancey, ometelka, ppalepu, ppostler, prdhamdh, ptisnovs, rbobbitt, rhel-process-autobot, sbunciak, sghai, sidsharm, simaishi, stcannon, suppawar, syedriko, tguha, vlaad, watson-tool-maintainers, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Tornado. When an application passes user-controlled input into static URL generation routines, directory traversal sequences are not properly validated. A remote attacker can exploit this vulnerability to cause a Denial of Service (DoS) by pointing the application to infinite system streams or special devices, causing the event loop to block indefinitely. Additionally, an attacker can obtain cryptographic hashes of arbitrary readable files on the system to verify their existence.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-08 02:01:56 UTC 
Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.static_url() and get_version() that allows attackers to hash files outside static_path using ../ sequences. Attackers controlling input passed to static_url() can obtain SHA-512 hashes of readable files to confirm their existence, or reference /dev/zero to block the event loop indefinitely.