Skip to content
NewA calmer, faster ZeroHour
StoryAdvisorylow

Ubuntu fixes second Tornado regression after incomplete CVE fix

1 source · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Ubuntu’s USN-8952-3 corrects a Tornado update that returned 403 errors for package symlinks after an earlier incomplete CVE fix.

Ubuntu published USN-8952-3 on November 11 to correct a regression introduced by USN-8952-2. That November 6 notice fixed an incomplete patch for CVE-2026-103263 that broke static file serving for applications subclassing Tornado’s StaticFileHandler, including Jupyter. Ubuntu says the USN-8952-2 fix could reject symlinks into system directories such as /usr/share, which distribution packages use for JavaScript and fonts, so affected web UIs returned 403 errors. USN-8952-3 addresses that symlink rejection. The original notice said Tornado mishandled certain HTTP requests and network inputs. These reports do not name package versions.

Key facts
  • USN-8952-2, dated 2026-11-06, corrected an incomplete CVE-2026-103263 fix.
  • The first regression broke static serving for StaticFileHandler subclasses, including Jupyter.
  • USN-8952-2 could reject symlinks into directories such as /usr/share.
  • Affected web UIs returned 403 errors for JavaScript and fonts.
  • USN-8952-3, dated 2026-11-11, fixes the symlink rejection regression.
  • The reports do not name affected or fixed package versions.
Analyze CVE-2026-103263 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Nov 6, 2026USN-8952-2 corrects incomplete CVE-2026-103263 Jupyter fix · Ubuntu Security Notices
  2. Nov 11, 2026USN-8952-3 fixes symlink rejections causing 403 errors · Ubuntu Security Notices

What each outlet adds

beyond the shared facts
  • Ubuntu Security NoticesUSN-8952-2 names CVE-2026-103263 and the Jupyter StaticFileHandler regression.
  • Ubuntu Security NoticesUSN-8952-3 says the prior fix rejected /usr/share symlinks, causing 403s.
CVEs
CVE-2026-103263
Vendors
CanonicalUbuntu
Products
TornadoJupyter
Organizations
Ubuntu

Coverage

oldest first · one row per article · UTC
  1. · 5d ago Ubuntu Security NoticesFirst report

    Tornado static file serving regression fixed in USN-8952-2

    USN-8952-2 corrects incomplete CVE-2026-103263 fix that broke Jupyter static file serving.

  2. · 12h ago Ubuntu Security Notices

    Ubuntu fixes Tornado update that blocked symlinked static files

    USN-8952-3 corrects an incomplete fix that returned 403 errors for symlinks into directories such as /usr/share.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-103263
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the…
8.2—