Tornado flaws may cause denial of service or expose data
Original title: USN-8952-1: Tornado vulnerabilities
USN-8952-1 lists six CVEs that could also let an attacker bypass access controls.
Ubuntu notice USN-8952-1 says Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly cause a denial of service, expose sensitive information, or bypass access controls. The provided notice text names six CVEs but no versions or exploitation status.
Unconfirmed: The snippet does not state whether the flaws are exploited or which versions are fixed.
- The notice cites CVE-2023-54397, CVE-2024-14029, and CVE-2026-91990.
- It also cites CVE-2026-91992, CVE-2026-103262, and CVE-2026-103263.
- No affected or fixed Tornado versions appear in the snippet.
Impact: denial of service, data exposure, or access-control bypass
| Product | Affected |
|---|---|
| Tornado | — |
- 1.Install the Tornado updates referenced by USN-8952-1.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-54397 | HTTP Request Smuggling via Malformed Content-Length Parsing in Tornado < 6.3.3 | 9.0 | — | ||
| CVE-2024-14029 | HTTP Request Smuggling via Duplicate Transfer-Encoding Headers in Tornado < 6.4.1 | 9.0 | — | ||
CVE-2026-103262+1 related CVE | Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of… | 8.7 group max | — | ||
| CVE-2026-91990 | Unauthenticated Memory-Amplification DoS in Tornado Multipart Form Parsing | 8.7 | — | ||
| CVE-2026-91992 | Credential Leak in Tornado CurlAsyncHTTPClient via Reused pycurl Handles (<6.5.7) | 8.2 | — |
From the original article
It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls. (CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992, CVE-2026-103262, CVE-2026-103263)
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.